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U.S. VULNERABILITIES TO MONEY LAUNDERING, DRUGS, 
AND TERRORIST FINANCING: HSBC CASE HISTORY 



This Report examines the anti-money laundering (AML) and terrorist financing 
vulnerabilities created when a global bank uses its U.S. affiliate to provide U.S. dollars, U.S. 
dollar services, and access to the U.S. financial system to high risk affiliates, high risk 
correspondent banks, and high risk clients. This Report also offers recommendations to 
strengthen correspondent AML controls to combat money laundering, drug trafficking, and 
terrorist financing. 

I. EXECUTIVE SUMMARY 

Over the last decade, the U.S. Senate Permanent Subcommittee on Investigations has 
worked to strengthen U.S. AML efforts by investigating how money launderers, terrorists, 
organized crime, corrupt officials, tax evaders, and other wrongdoers have utilized U.S. financial 
institutions to conceal, transfer, and spend suspect funds. 1 In 2001, the Subcommittee focused, 
in particular, on how U.S. banks, through the correspondent services they provide to foreign 
financial institutions, had become conduits for illegal proceeds associated with organized crime, 
drug trafficking, and financial fraud. 2 Correspondent banking occurs when one financial 
institution provides services to another financial institution to move funds, exchange currencies, 
cash monetary instruments, or carry out other financial transactions. The Subcommittee's 2001 
investigation showed not only how some poorly managed or corrupt foreign banks used U.S. 
bank accounts to aid and abet, commit, or allow clients to commit wrongdoing, but also how 
U.S. financial institutions could protect themselves and the U.S. financial system from misuse. 

In response to that investigation and the money laundering vulnerabilities exposed by the 
9/1 1 terrorist attack, Congress enacted stronger AML laws as part of the Patriot Act of 2002, 
including stronger provisions to combat the misuse of correspondent services. Federal bank 
regulators followed with stronger regulations 4 and examination requirements 5 to guard against 



See, e.g., U.S. Senate Permanent Subcommittee on Investigations, "Keeping Foreign Corruption out of the United 
States," S.Hrg. 1 1 1-540 (Feb. 4, 2010); "Tax Haven Banks and U.S. Tax Compliance," S.Hrg. 1 10-614 (July 17 and 
25, 2008); "Tax Haven Abuses: The Enablers, The Tools and Secrecy," S.Hrg. 109-797 (Aug. 1, 2006); "Money 
Laundering and Foreign Corruption: Enforcement and Effectiveness of the Patriot Act," S.Hrg. 108-633 (July 15, 
2004); "Role of U.S. Correspondent Banking in International Money Laundering," S.Hrg. 107-84 (March 1, 2 and 6, 
2001); and "Private Banking and Money Laundering: A Case Study of Opportunities and Vulnerabilities," S.Hrg. 
106-428 (Nov. 9 and 10, 1999). See also U.S. Senate Committee on Homeland Security and Governmental Affairs, 
"State Business Incorporation - 2009," S.Hrg. 1 1 1-953 (June 18 and Nov. 5, 2009). 

2 "Role of U.S. Correspondent Banking in International Money Laundering," U.S. Senate Permanent Subcommittee 
on Investigations, S.Hrg. 107-84 (March 1, 2 and 6, 2001)(hereinafter "2001 Subcommittee Hearing on 
Correspondent Banking"), at 1. 

3 See, e.g., Sections 312, 313, and 319(b) of the USA Patriot Act (requiring due diligence to be conducted when 
opening accounts for foreign banks, with enhanced due diligence for offshore banks and banks in high risk 
jurisdictions; prohibiting the opening of correspondent accounts for shell banks; and strengthening the ability of U.S. 
regulators to obtain correspondent account records). 

4 See, e.g., 31 CFR §§103.175,103.176, 103.177, 103.185. 

5 See, e.g., 4/29/2010 "Bank Secrecy Act/ Anti-Money Laundering Examination Manual," issued by the Federal 
Financial Institutions Examination Council, "Foreign Correspondent Account Recordkeeping and Due Diligence," at 
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money laundering through correspondent accounts. In response, over the next ten years, U.S. 
banks substantially strengthened their correspondent AML controls. Before the 2002 Patriot Act, 
for example, most U.S. banks opened correspondent accounts for any foreign bank with a 
banking license; now, most U.S. banks evaluate the riskiness of each foreign bank's owners, 
business lines, products, clients, and AML controls before agreeing to open an account. They 
also routinely monitor account activity and wire transfers for suspicious activity, with enhanced 
monitoring of high risk correspondents. In addition, before the 2002 Patriot Act, some U.S. 
banks readily opened accounts for foreign shell banks, meaning banks without any physical 
presence in any jurisdiction; today, in accordance with the Patriot Act's ban on shell bank 
accounts, all U.S. banks take measures to ensure they don't provide services to such banks, the 
ban on shell bank accounts has become an international AML standard, 6 and the thousands of 
stand-alone shell banks licensed by the Bahamas, Cayman Islands, Nauru, and other jurisdictions 
have virtually disappeared. 

At the same time, the money laundering risks associated with correspondent banking 
have not been eliminated. Correspondent accounts continue to provide a gateway into the U.S. 
financial system, and wrongdoers continue to abuse that entryway. This investigation takes a 
fresh look at the U.S. vulnerabilities to money laundering and terrorist financing associated with 
correspondent banking, focusing in particular on the operations of global banks with U.S. 
affiliates that enable foreign financial institutions to gain access to the U.S. financial system. 

HSBC Case Study. To examine the current money laundering and terrorist financing 
threats associated with correspondent banking, the Subcommittee selected HSBC as a case study. 
HSBC is one of the largest financial institutions in the world, with over $2.5 trillion in assets, 89 
million customers, 300,000 employees, and 2011 profits of nearly $22 billion. HSBC, whose 
initials originally stood for Hong Kong Shanghai Banking Corporation, now has operations in 
over 80 countries, with hundreds of affiliates spanning the globe. Its parent corporation, HSBC 
Holdings pic, called "HSBC Group," is headquartered in London, and its Chief Executive 
Officer is located in Hong Kong. 

Its key U.S. affiliate is HSBC Bank USA N.A. (HBUS). HBUS operates more than 470 
bank branches throughout the United States, manages assets totaling about $200 billion, and 
serves around 3.8 million customers. It holds a national bank charter, and its primary regulator is 
the U.S. Office of the Comptroller of the Currency (OCC), which is part of the U.S. Treasury 
Department. HBUS is headquartered in McLean, Virginia, but has its principal office in New 
York City. HSBC acquired its U.S. presence by purchasing several U.S. financial institutions, 
including Marine Midland Bank and Republic National Bank of New York. 

A senior HSBC executive told the Subcommittee that HSBC acquired its U.S. affiliate, 
not just to compete with other U.S. banks for U.S. clients, but primarily to provide a U.S. 
platform to its non-U. S. clients and to use its U.S. platform as a selling point to attract still more 
non-U. S. clients. HSBC operates in many jurisdictions with weak AML controls, high risk 



117-129, 183-187, http://www.ffiec.gov/bsa_aml_infobase/documents/BSA_AML_Man_2010.pdf. Prior versions 
of this Manual were issued in 2005 and 2007. 

6 See "International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation: 
The FATF Recommendations," issued by the Financial Action Task Force (2/2012), FATF Recommendation 13. 
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clients, and high risk financial activities including Asia, Middle East, and Africa. Over the past 
ten years, HSBC has also acquired affiliates throughout Latin America. In many of these 
countries, the HSBC affiliate provides correspondent accounts to foreign financial institutions 
that, among other services, are interested in acquiring access to U.S. dollar wire transfers, foreign 
exchange, and other services. As a consequence, HSBC's U.S. affiliate, HBUS, is required to 
interact with other HSBC affiliates and foreign financial institutions that face substantial AML 
challenges, often operate under weaker AML requirements, and may not be as familiar with, or 
respectful of, the tighter AML controls in the United States. HBUS' correspondent services, 
thus, provide policymakers with a window into the vast array of money laundering and terrorist 
financing risks confronting the U.S. affiliates of global banks. 

The Subcommittee also examined HSBC because of its weak AML program. In 
September 2010, the OCC issued a lengthy Supervisory Letter citing HBUS for violating federal 
AML laws, including by maintaining an inadequate AML program. In October 2010, the OCC 
issued a Cease and Desist Order requiring HSBC to strengthen multiple aspects of its AML 
program. 7 The identified problems included a once massive backlog of over 17,000 alerts 
identifying possible suspicious activity that had yet to be reviewed; ineffective methods for 
identifying suspicious activity; a failure to file timely Suspicious Activity Reports with U.S. law 
enforcement; a failure to conduct any due diligence to assess the risks of HSBC affiliates before 
opening correspondent accounts for them; a 3-year failure by HBUS, from mid-2006 to mid- 
2009, to conduct any AML monitoring of $15 billion in bulk cash transactions with those same 
HSBC affiliates, despite the risks associated with large cash transactions; poor procedures for 
assigning country and client risk ratings; a failure to monitor $60 trillion in annual wire transfer 
activity by customers domiciled in countries rated by HBUS as lower risk; inadequate and 
unqualified AML staffing; inadequate AML resources; and AML leadership problems. Since 
many of these criticisms targeted severe, widespread, and longstanding AML deficiencies, they 
also raised questions about how the problems had been allowed to accumulate and why the OCC 
had not compelled corrective action earlier. 

During the course of its investigation into HSBC's AML deficiencies, the Subcommittee 
issued multiple subpoenas and collected and reviewed over 1.4 million documents, including 
bank records, correspondence, emails, and legal pleadings. The Subcommittee staff also 
conducted over 75 interviews with officials at HSBC Group, HBUS, and other HSBC affiliates, 
as well as with U.S. banking regulators. In addition, the Subcommittee received numerous 
briefings from HSBC legal counsel, initiated inquiries with foreign banks that had HSBC 
accounts, and consulted with experts on AML and terrorist financing issues. HSBC was fully 
cooperative with the inquiry, producing documentation and witnesses from around the world, 
including documents for which it could have claimed privilege. 

As a result of its investigation, the Subcommittee has focused on five issues illustrating 
key AML and terrorist financing problems that continue to impact correspondent banking in the 
United States. They include opening U.S. correspondent accounts for high risk affiliates without 
conducting due diligence; facilitating transactions that hinder U.S. efforts to stop terrorists, drug 



7 On the same day, in coordination with the OCC, the Federal Reserve issued a Cease and Desist order to HBUS' 
holding company, HSBC North America Holdings, Inc. (HNAH), citing HNAH for an inadequate AML program 
and requiring it to revamp and strengthen both its program and that of HBUS. 
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traffickers, rogue jurisdictions, and other from using the U.S. financial system; providing U.S. 
correspondent services to banks with links to terrorism; clearing bulk U.S. dollar travelers 
cheques despite signs of suspicious activity; and offering high risk bearer share corporate 
accounts. Avoiding the money laundering risks involved in these activities requires an effective 
AML program, with written standards, knowledgeable and adequate staff, the infrastructure 
needed to monitor account and wire transfer activity for suspicious transactions, effective AML 
training, and a compliance culture that values obtaining accurate client information. In addition 
to focusing on these five issues at HBUS, the Subcommittee investigation examined the 
regulatory failures that allowed these and other AML problems to fester for years. 

Servicing A High Risk Affiliate. In 2001, the Subcommittee's investigation debunked 
the notion that U.S. banks should open a correspondent account for any foreign bank with a 
banking license, establishing instead the need to use due diligence to evaluate the money 
laundering and terrorist financing risks posed by a specific foreign financial institution before 
opening an account. Today, some U.S. affiliates of global banks engage in an equally ill-advised 
practice, opening correspondent accounts for any affiliate owned by the parent holding 
corporation, with no analysis of the AML or terrorist financing risks. 

Until recently, HSBC Group policy instructed its affiliates to assume that all HSBC 
affiliates met the Group's AML standards and to open correspondent accounts for those affiliates 
without additional due diligence. For years, HBUS followed that policy, opening U.S. 
correspondent accounts for HSBC affiliates without conducting any AML due diligence. Those 
affiliates have since become major clients of the bank. In 2009, for example, HBUS determined 
that "HSBC Group affiliates clear[ed] virtually all USD [U.S. dollar] payments through accounts 
held at HBUS, representing 63% of all USD payments processed by HBUS." 8 HBUS failed to 
conduct due diligence on HSBC affiliates despite a U.S. law that has required all U.S. banks, 
since 2002, to conduct these due diligence reviews before opening a U.S. correspondent account 
for any foreign financial institution, with no exception made for foreign affiliates. 

One HSBC affiliate that illustrates the AML problems is HSBC Mexico, known as 
HBMX. HBUS should have, but did not, treat HBMX as a high risk correspondent client subject 
to enhanced due diligence and monitoring. HBMX operated in Mexico, a country under siege 
from drug crime, violence and money laundering; it had high risk clients, such as Mexican casas 
de cambios and U.S. money service businesses; and it offered high risk products, such as U.S. 
dollar accounts in the Cayman Islands. In addition, from 2007 through 2008, HBMX was the 
single largest exporter of U.S. dollars to HBUS, shipping $7 billion in cash to HBUS over two 
years, outstripping larger Mexican banks and other HSBC affiliates. Mexican and U.S. 
authorities expressed repeated concern that HBMX's bulk cash shipments could reach that 
volume only if they included illegal drug proceeds.. The concern was that drug traffickers 
unable to deposit large amounts of cash in U.S. banks due to AML controls, were transporting 
U.S. dollars to Mexico, arranging for bulk deposits there, and then using Mexican financial 
institutions to insert the cash back into the U.S. financial system. 

In addition to its high risk location, clients, and activities, HMBX had a history of severe 
AML deficiencies. Its AML problems included a widespread lack of Know- Your Customer 



8 See 9/9/2009 chart entitled, "HSBC Profile," included in "HSBC OFAC Compliance Program," a presentation 
prepared by HSBC and provided to the OCC, at HSBC OCC 8874197. 
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(KYC) information in client files; a dysfunctional monitoring system; bankers who resisted 
closing accounts despite evidence of suspicious activity; high profile clients involved in drug 
trafficking; millions of dollars in suspicious bulk travelers cheque transactions; inadequate 
staffing and resources; and a huge backlog of accounts marked for closure due to suspicious 
activity, but whose closures were delayed. For eight years, from 2002 to 2010, HSBC Group 
oversaw efforts to correct HBMX's AML deficiencies, while those efforts fell short. At the 
same time, HSBC Group watched HBMX utilize its U.S. correspondent account, without alerting 
HBUS to the AML risks it was incurring. 

HBUS compounded the AML risks it incurred from HBMX through its own AML 
deficiencies, which included failing to investigate or evaluate HBMX's AML risks. HBUS also 
failed, from mid-2006 to mid-2009, to conduct any AML monitoring of its U.S. dollar 
transactions with HSBC affiliates, including HBMX, despite the obvious well-known risks 
attendant with large cash transactions. In addition, because HBUS deemed HBMX to be located 
in a low risk country, HBUS failed until 2009, to monitor HBMX's wire transfer or account 
activity. HBMX illustrates the money laundering and drug trafficking risks that result when the 
U.S. affiliate of a global bank serves as the U.S. gateway for a high risk affiliate allowed to 
operate with no initial due diligence or ongoing monitoring. 

Circumventing OFAC Prohibitions. The United States has devoted significant 
resources to stopping some of the most dangerous persons and jurisdictions threatening the world 
today from utilizing the U.S. financial system, including terrorists, persons involved with 
weapons of mass destruction, drug traffickers, and persons associated with rogue jurisdictions 
such as Iran, North Korea, and Sudan. To implement the law, the U.S. Treasury Department's 
Office of Foreign Assets Control (OFAC) has developed a list of prohibited persons and 
countries which banks use to create an "OFAC filter" to identify and halt potentially prohibited 
transactions. Transactions stopped by this filter typically undergo an individualized review to 
see if the transaction can proceed or the funds must be blocked. 

Because the OFAC filter can end up delaying or blocking transactions that are permitted 
under U.S. law or by other jurisdictions, some non-U. S. financial institutions have used tactics to 
circumvent it. Common tactics include stripping information from wire transfer documentation 
to conceal the participation of a prohibited person or country, or characterizing a transaction as a 
transfer between banks in approved jurisdictions, while omitting underlying payment details that 
would disclose participation of a prohibited originator or beneficiary. In the case of Iran, some 
foreign banks also abused what were known as "U-turn" transactions, which were allowable 
transactions under Treasury regulations prior to November 2008. In recent years, the United 
States has imposed steep penalties on banks that violated the OFAC prohibitions. 

At HBUS, documents provided to the Subcommittee indicate that, for years, some HSBC 
affiliates took action to circumvent the OFAC filter when sending OFAC sensitive transactions 
through their U.S. dollar correspondent accounts at HBUS. From at least 2001 to 2007, two 
HSBC affiliates, HSBC Europe (HBEU) and HSBC Middle East (HBME), repeatedly sent U- 
turn transactions through HBUS without disclosing links to Iran, even though they knew HBUS 
required full transparency to process U-turns. To avoid triggering the OFAC filter and an 
individualized review by HBUS, HBEU systematically altered transaction information to strip 
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out any reference to Iran and characterized the transfers as between banks in approved 
jurisdictions. The affiliates' use of these practices, which even some within the bank viewed as 
deceptive, was repeatedly brought to the attention of HSBC Group Compliance, by HBUS 
compliance personnel and by HBEU personnel who objected to participating in the document 
alteration and twice announced deadlines to end the activity. Despite this information, HSBC 
Group Compliance did not take decisive action to stop the conduct or inform HBUS about the 
extent of the activity. At the same time, while some at HBUS claimed not to have known they 
were processing undisclosed Iranian transactions from HSBC affiliates, internal documents show 
key senior HBUS officials were informed as early as 2001. In addition, HBUS' OFAC filter 
repeatedly stopped Iranian transactions that should have been disclosed to HBUS by HSBC 
affiliates, but were not. Despite evidence of what was taking place, HBUS failed to get a full 
accounting of what its affiliates were doing or ensure all Iranian transactions sent by HSBC 
affiliates were stopped by the OFAC filter and reviewed to ensure they were OFAC compliant. 
In addition, documents show that, from 2002 to 2007, some HSBC affiliates sent potentially 
prohibited transactions through HBUS involving Burma, Cuba, North Korea, Sudan, and other 
prohibited countries or persons. Other documents indicate that some HSBC affiliates may have 
sent non-U. S. dollar messaging traffic through U.S. servers in which the OFAC filter was not 
turned on or was restricted. 

An outside auditor hired by HBUS has so far identified, from 2001 to 2007, more than 
28,000 undisclosed, OFAC sensitive transactions that were sent through HBUS involving $19.7 
billion. Of those 28,000 transactions, nearly 25,000 involved Iran, while 3,000 involved other 
prohibited countries or persons. The review has characterized nearly 2,600 of those transactions, 
including 79 involving Iran, and with total assets of more than $367 million, as "Transactions of 
Interest" requiring additional analysis to determine whether violations of U.S. law occurred. 
While the aim in many of those cases may have been to avoid the delays associated with the 
OFAC filter and individualized reviews, rather than to facilitate prohibited transactions, actions 
taken by HSBC affiliates to circumvent OFAC safeguards may have facilitated transactions on 
behalf of terrorists, drug traffickers, or other wrongdoers. While HBUS insisted, when asked, 
that HSBC affiliates provide fully transparent transaction information, when it obtained evidence 
that some affiliates were acting to circumvent the OFAC filter, HBUS failed to take decisive 
action to confront those affiliates and put an end to the conduct. HBUS' experience 
demonstrates the strong measures that the U.S. affiliate of a global bank must take to prevent 
affiliates from circumventing OFAC prohibitions. 

Disregarding Links to Terrorism. For decades, HSBC has been one of the most 
active global banks in the Middle East, Asia, and Africa, despite being aware of the 
terrorist financing risks in those regions. In particular, HSBC has been active in Saudi 
Arabia, conducting substantial banking activities through affiliates as well as doing 
business with Saudi Arabia's largest private financial institution, Al Rajhi Bank. After 
the 9-11 terrorist attack in 2001, evidence began to emerge that Al Rajhi Bank and some 
of its owners had links to financing organizations associated with terrorism, including 
evidence that the bank's key founder was an early financial benefactor of al Qaeda. In 
2005, HSBC announced internally that its affiliates should sever ties with Al Rajhi Bank, 
but then reversed itself four months later, leaving the decision up to each affiliate. HSBC 
Middle East, among other HSBC affiliates, continued to do business with the bank. 
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Due to terrorist financing concerns, HBUS closed the correspondent banking and 
banknotes accounts it had provided to Al Rajhi Bank. For nearly two years, HBUS 
Compliance personnel resisted pressure from HSBC personnel in the Middle East and 
United States to resume business ties with Al Rajhi Bank. In December 2006, however, 
after Al Rajhi Bank threatened to pull all of its business from HSBC unless it regained 
access to HBUS' U.S. banknotes program, HBUS agreed to resume supplying Al Rajhi 
Bank with shipments of U.S. dollars. Despite ongoing troubling information, HBUS 
provided nearly $1 billion in U.S. dollars to Al Rajhi Bank until 2010, when HSBC 
decided, on a global basis, to exit the U.S. banknotes business. HBUS also supplied U.S. 
dollars to two other banks, Islami Bank Bangladesh Ltd. and Social Islami Bank, despite 
evidence of links to terrorist financing. Each of these specific cases shows how a global 
bank can pressure its U.S. affiliate to provide banks in countries at high risk of terrorist 
financing with access to U.S. dollars and the U.S. financial system. 

Clearing Suspicious Bulk Travelers Cheques. Another AML issue involves HBUS' 
clearing more than $290 million in bulk U.S. dollar travelers checks in less than four years for a 
Japanese regional bank, Hokuriku Bank, despite evidence of suspicious activity. From at least 
2005 to 2008, HBUS cleared bulk travelers cheques for Hokuriku Bank on a daily basis, at times 
clearing $500,000 or more in U.S. dollars per day. The cheques were in denominations of $500 
or $1,000, submitted in large blocks of sequentially numbered cheques, and signed and 
countersigned with the same illegible signature. An OCC examination which determined that 
HBUS was clearing travelers cheques with inadequate AML controls, discovered the stacks of 
Hokuriku travelers cheques being processed on a daily basis, and directed HBUS to investigate. 
When HBUS sought more information, Hokuriku Bank at first delayed responding, then 
provided minimal information, and finally declined to investigate further, claiming to be 
constrained by bank secrecy laws from disclosing client- specific information. HBUS eventually 
learned that the travelers cheques were purchased by Russians from a bank in Russia, a country 
at high risk of money laundering. HBUS also learned that the Japanese bank had little KYC 
information or understanding why up to $500,000 or more in bulk U.S. dollar travelers cheques 
purchased in Russia were being deposited on a daily basis into one of 30 different Japanese 
accounts of persons and corporations supposedly in the used car business. 

In October 2008, under pressure from the OCC, HBUS stopped processing the travelers 
cheques, but continued the correspondent relationship, despite the Japanese bank's poor AML 
controls. Two years later, in 2010, an OCC examination uncovered the ongoing relationship, 
between HSBC and Hokuriku, which the OCC thought had ended. In 2012, after the 
Subcommittee inquired about the account, HBUS closed it. Since travelers cheques have been 
misused by terrorists, drug traffickers, and other criminals, the HBUS experience shows how a 
U.S. affiliate with ineffective AML controls can end up clearing suspicious bulk travelers 
cheques and facilitating the movement of hundreds of millions of U.S. dollars across 
international lines to unknown recipients. 

Offering Bearer Share Accounts. Over the course of a decade, HBUS opened over 
2,000 accounts in the name of bearer share corporations, a notorious type of corporation that 
invites secrecy and wrongdoing by assigning ownership to whomever has physical possession of 
the shares. At its peak, HBUS' Miami office had over 1,670 bearer share accounts; the New 
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York office had over 850; and the Los Angeles office had over 30. The Miami bearer share 
accounts alone held assets totaling an estimated $2.6 billion, and generated annual bank revenues 
of $26 million. Multiple internal audits and regulatory examinations criticized the accounts as 
high risk and advocated that HBUS either take physical custody of the shares or require the 
corporations to register the shares in the names of the shareholders, but HBUS bankers initially 
resisted tightening AML controls, and regulators took no enforcement action. 

Two examples of the accounts illustrate the risks they posed. In the first, Miami Beach 
hotel developers, Mauricio Cohen Assor and Leon Cohen Levy, father and son, used bearer share 
accounts they opened for Blue Ocean Finance Ltd. and Whitebury Shipping Time-Sharing Ltd. 
to help hide $150 million in assets and $49 million in income. In 2010, both were convicted of 
criminal tax fraud and filing false tax returns, sentenced to ten years in prison, and ordered to pay 
back taxes, interest, and penalties totaling more than $17 million. A second example involves a 
wealthy and powerful Peruvian family which pressed HBUS to grant a waiver from its AML 
requirements that bearer share corporations either register their shares or place those shares in 
bank custody. Bank documents showed how HBUS bankers pressed Compliance personnel to 
grant the waiver to please a wealthy client. These accounts demonstrate the AML risks 
associated with bearer share accounts, whose owners seek to hide their identities. Today, 
following an initiative that concluded in 201 1, HBUS has reduced its bearer share accounts to 
26, most of which are frozen, while at the same time maintaining a policy that allows the bank to 
open new bearer share accounts in the future. 

Regulatory Failures. HBUS' severe AML deficiencies did not happen overnight; they 
accumulated over time, even though its primary regulator, the OCC, conducted regular AML 
examinations. Part of the reason HBUS' AML problems were not cured is attributable to certain 
peculiar and ineffective aspects of the OCC's AML oversight effort. 

First, unlike other U.S. bank regulators, the OCC does not treat AML deficiencies as a 
matter of bank safety and soundness or a management problem. Instead it treats AML 
deficiencies as a consumer compliance matter, even though AML laws and consumer protection 
laws have virtually nothing in common. One consequence of this approach is that the OCC 
considers AML problems when assigning a bank's consumer compliance rating, but not when 
assigning the bank's management rating or its overall composite rating. As a result, AML 
deficiencies do not routinely lower the ratings that national banks receive as part of their safety 
and soundness evaluations, and so do not increase the deposit insurance that banks pay for 
incurring heightened risk, contrary to how AML problems are handled at other federal banking 
agencies. At HBUS, after citing the bank for severe AML deficiencies, the OCC lowered its 
consumer compliance rating but not its management rating. 

A second problem is that the OCC has adopted a practice of foregoing the citation of a 
statutory or regulatory violation in its Supervisory Letters and annual Reports of Examination 
when a bank fails to comply with one of the four mandatory components of an AML program. 
The four minimum statutory requirements of an AML program are AML internal controls, an 
AML compliance officer, AML training, and independent testing of the effectiveness of its AML 
program. By consistently treating a failure to meet one or even several of these statutory 
requirements as a "Matter Requiring Attention" instead of a legal violation, the OCC diminishes 
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the importance of meeting each requirement, sends a more muted message about the need for 
corrective action, and makes enforcement actions more difficult to pursue if an AML deficiency 
persists. In contrast, citing a violation of law when one critical component of a bank's AML 
program is inadequate sends a strong message to bank management that its AML program is 
deficient, does not meet minimum statutory requirements, and requires remediation to ensure 
compliance with the law. At HBUS, the OCC identified 83 Matters Requiring Attention over 
five years, without once citing a legal violation of federal AML law. It was only when the OCC 
found HBUS' entire AML program to be deficient that the OCC finally cited the bank for a legal 
violation. 

Additional problems illustrated by the HBUS case history include the OCC's practice of 
conducting narrowly focused AML examinations of specific banking units without also assessing 
HBUS' overall AML program; the OCC's reluctance, despite mounting AML deficiencies, to 
make timely use of formal and informal enforcement actions to compel improvements in HBUS' 
AML program; and the practice by some OCC examiners to issue Supervisory Letters that 
sometimes muted AML examination criticisms or weakened recommendations for AML reforms 
at HBUS. 

While the OCC insists that its AML approach has merit, the HSBC case history, like the 
Riggs Bank case history examined by this Subcommittee eight years ago, provides evidence that 
the current OCC system has tolerated severe AML deficiencies for years, permitted national 
banks to delay or avoid correcting identified problems, and allowed smaller AML issues to 
accumulate into a massive problem before OCC enforcement action was taken. An experienced 
OCC AML examiner told the Subcommittee: "I thought I saw it all with Riggs but HSBC was 
the worst situation I'd ever seen," yet during the six-year period from 2004 to 2010, OCC 
officials did not take any formal or informal enforcement action to compel HBUS to strengthen 
its AML program, essentially allowing its AML problems to fester. In 2009, after learning of 
two law enforcement investigations involving AML issues at the bank, the OCC suddenly 
expanded and intensified an ongoing AML examination and allowed it to consider a wide range 
of AML issues. The OCC examination culminated in the issuance, in September 2010, of a 
blistering supervisory letter listing numerous, serious AML problems at the bank. In October 
2010, the OCC also issued a Cease and Desist Order requiring HBUS to revamp its AML 
controls. 

In response, HBUS has announced a number of key organizational and policy initiatives 
to improve its AML program in the United States and globally. While those initiatives are 
promising, HBUS announced similarly promising AML reforms in 2003, when confronted with 
an AML enforcement action by the Federal Reserve Bank of New York and New York State 
Banking Department. Even before the OCC lifted that order in 2006, HBUS' AML program 
deteriorated. Both HBUS and the OCC will have to undertake a sustained effort to ensure the 
newest round of changes produce a better AML outcome. 

HSBC is the quintessential global bank, operating hundreds of affiliates in 80 countries, 
with its U.S. affiliate acting as the gateway into the U.S. financial system for the entire network. 



9 See "Money Laundering and Foreign Corruption: Enforcement and Effectiveness of the Patriot Act," U.S. Senate 
Permanent Subcommittee on Investigations, S.Hrg. 108-633 (July 15, 2004). 
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The OCC allowed AML problems at HBUS to build up until they represented major AML 
vulnerabilities for the United States. Going forward, HBUS needs far stronger controls to ensure 
it doesn't leave AML risks to the U.S. financial system unattended; the OCC needs a much better 
approach to resolve AML problems in a more effective and timely manner. 

A. Findings 

This Report makes the following findings of fact. 

(1) Longstanding Severe AML Deficiencies. HBUS operated its correspondent 
accounts for foreign financial institutions with longstanding, severe AML 
deficiencies, including a dysfunctional AML monitoring system for account and 
wire transfer activity, an unacceptable backlog of 17,000 unreviewed alerts, 
insufficient staffing, inappropriate country and client risk assessments, and late or 
missing Suspicious Activity Reports, exposing the United States, to money 
laundering, drug trafficking, and terrorist financing risks. 

(2) Taking on High Risk Affiliates. HBUS failed to assess the AML risks associated 
with HSBC affiliates before opening correspondent accounts for them, failed to 
identify high risk affiliates, and failed for years to treat HBMX as a high risk 
accountholder. 

(3) Circumventing OFAC Prohibitions. For years in connection with Iranian U-turn 
transactions, HSBC allowed two non-U. S. affiliates to engage in conduct to avoid 
triggering the OFAC filter and individualized transaction reviews. While HBUS 
insisted, when asked, that HSBC affiliates provide fully transparent transaction 
information, when it obtained evidence that some affiliates were acting to 
circumvent the OFAC filter, HBUS failed to take decisive action to confront those 
affiliates and put an end to conduct which even some within the bank viewed as 
deceptive. 

(4) Disregarding Terrorist Links. HBUS provided U.S. correspondent accounts to 
some foreign banks despite evidence of links to terrorist financing. 

(5) Clearing Suspicious Bulk Travelers Cheques. In less than four years, HBUS 
cleared over $290 million in sequentially numbered, illegibly signed, bulk U.S. 
dollar travelers cheques for Hokuriku Bank, which could not explain why its clients 
were regularly depositing up to $500,000 or more per day in U.S. dollar travelers 
cheques obtained in Russia into Japanese accounts, supposedly for selling used 
cars; even after learning of Hokuriku' s poor AML controls, HBUS continued to do 
business with the bank. 



(6) 



Offering Bearer Share Accounts. Over the course of a decade, HBUS opened 
over 2,000 high risk bearer share corporate accounts with inadequate AML controls. 
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(7) Allowing AML Problems to Fester. The OCC allowed HBUS' AML deficiencies 
to fester for years, in part due to treating HBUS' AML problems as consumer 
compliance matters rather than safety and soundness problems, failing to make 
timely use of formal and informal enforcement actions to compel AML reforms at 
the bank, and focusing on AML issues in specific HBUS banking units without also 
viewing them on an institution- wide basis. 

B. Recommendations 

This Report makes the following recommendations. 

(1) Screen High Risk Affiliates. HBUS should reevaluate its correspondent 
relationships with HSBC affiliates, including by reviewing affiliate AML and 
compliance audit findings, identifying high risk affiliates, designating affiliate 
accounts requiring enhanced monitoring, and closing overly risky accounts. HBUS 
should conduct a special review of the HBMX account to determine whether it 
should be closed. 

(2) Respect OFAC Prohibitions. HSBC Group and HBUS should take concerted 
action to stop non-U. S. HSBC affiliates from circumventing the OFAC filter that 
screens transactions for terrorists, drug traffickers, rogue jurisdictions, and other 
wrongdoers, including by developing audit tests to detect undisclosed OFAC 
sensitive transactions by HSBC affiliates. 

(3) Close Accounts for Banks with Terrorist Financing Links. HBUS should 
terminate correspondent relationships with banks whose owners have links to, or 
present high risks of involvement with, terrorist financing. 

(4) Revamp Travelers Cheque AML Controls. HBUS should restrict its acceptance 
of large blocks of sequentially numbered U.S. dollar travelers cheques from HSBC 
affiliates and foreign financial institutions; identify affiliates and foreign financial 
institutions engaged in suspicious travelers cheque activity; and stop accepting 
travelers cheques from affiliates and foreign banks that sell or cash U.S. dollar 
travelers cheques with little or no KYC information. 

(5) Boost Information Sharing Among Affiliates. HSBC should require AML 
personnel to routinely share information among affiliates to strengthen AML 
coordination, reduce AML risks, and combat wrongdoing. 

(6) Eliminate Bearer Share Accounts. HBUS should close its remaining 26 bearer 
share corporate accounts, eliminate this type of account, and instruct financial 
institutions using HBUS correspondent accounts not to execute transactions 
involving bearer share corporations. U.S. financial regulators should prohibit U.S. 
banks from opening or servicing bearer share accounts. 
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(7) Increase HBUS' AML Resources. HBUS should ensure a full time professional 
serves as its AML director, and dedicate additional resources to hire qualified AML 
staff, implement an effective AML monitoring system for account and wire transfer 
activity, and ensure alerts, including OFAC alerts, are reviewed and Suspicious 
Activity Reports are filed on a timely basis. 

(8) Treat AML Deficiencies as a Matter of Safety and Soundness. The OCC should 
align its practice with that of other federal bank regulators by treating AML 
deficiencies as a safety and soundness matter, rather than a consumer compliance 
matter, and condition management CAMELS ratings in part upon effective 
management of a bank's AML program. 

(9) Act on Multiple AML Problems. To ensure AML problems are corrected in a 
timely fashion, the OCC should establish a policy directing that the Supervision 
Division coordinate with the Enforcement and Legal Divisions to conduct an 
institution- wide examination of a bank' s AML program and consider use of formal 
or informal enforcement actions, whenever a certain number of Matters Requiring 
Attention or legal violations identifying recurring or mounting AML problems are 
identified through examinations. 

(10) Strengthen AML Examinations. The OCC should strengthen its AML 
examinations by citing AML violations, rather than just Matters Requiring 
Attention, when a bank fails to meet any one of the statutory minimum 
requirements for an AML program; and by requiring AML examinations to focus 
on both specific business units and a bank's AML program as a whole. 
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II. GENERAL BACKGROUND 

This section provides a general overview of HSBC Group, HSBC Bank USA (HBUS), 
and the HBUS compliance and anti-money laundering (AML) program. 

A. Background on HSBC Group and HBUS 

HSBC Group is one of the largest financial institutions in the world, with over $2.5 
trillion in assets, 89 million customers, and 2011 profits of nearly $22 billion. 10 Its parent 
corporation, HSBC Holdings pic, often referred to by the bank as "HSBC Group," is 
headquartered in London. Despite its London headquarters, the principal office of the Group 
Chief Executive is located in Hong Kong. 11 Altogether, HSBC has about 300,000 employees 
and 7,200 offices in over 80 countries, including North America, Europe, Asia, Latin America, 
the Middle East, and Africa. 12 

United States Operations. Among other entities, the Group owns HSBC Overseas 
Holdings (UK) Ltd. ("HSBC Overseas Holdings"), which oversees its operations in the United 
States and Canada. HSBC Overseas Holdings owns, in turn, HSBC North America Holdings 
Inc. ("HNAH," pronounced "Hannah"), one of the ten largest bank holding companies in the 
United States. HNAH has assets of about $345 billion, is headquartered in New York City, and 
is overseen by the Federal Reserve. 13 Through various subsidiaries, HNAH owns three key 
HSBC financial institutions in the United States: HSBC Bank USA N.A. ("HBUS"); HSBC 
Securities (USA) Inc. ("HSBC Securities"); and HSBC Finance Corporation. 

HBUS operates more than 470 bank branches throughout the United States, manages 
assets totaling about $210 billion, and serves around 4 million customers. 14 It holds a national 
bank charter and its primary regulator is the Office of the Comptroller of the Currency (OCC), 
which is part of the U.S. Treasury Department. Because it holds insured deposits, its secondary 
regulator is the Federal Deposit Insurance Corporation (FDIC). HBUS is the principal subsidiary 
of HSBC USA Inc. ("HUSI"), a bank holding company which is a wholly-owned subsidiary of 
HNAH. 15 HBUS is headquartered in McLean, Virginia, and has its principal office in New York 



,u See "HSBC Holdings pic 2011 Results-Highlights," (2/12/12), at 1-2, http://www.hsbc.eom/l/P A_esf-ca-app- 
content/content/assets/investor_relations/hsbc2011arn.pdf; "HSBC Holdings pic Annual Report and Accounts 
201 1," at 1, http://www.hsbc.eom/l/PA_esf-ca-app-content/content/assets/investor_relations/hsbc201 lara0.pdf 
(hereinafter "HSBC Group 201 1 Annual Report"). 

"See "HSBC Announces New Leadership Team," (9/24/10), media release prepared by HSBC, 
http://www.hsbc.eom/l/2/newsroom/news/2010/hsbc-announces-new-leadership. 

12 HSBC Group 201 1 Annual Report at 1; "HSBC Announces New Leadership Team," (9/24/10), media release 
prepared by HSBC, http://www.hsbc.eom/l/2/newsroom/news/2010/hsbc-announces-new-leadership. 

13 See "HSBC North America Holdings Inc. Fact Sheet," at 1, 

http://www.us.hsbc.eom/l/PA_l_083Q9FJ08A002FBP5S00000000/content/usshared/Inside%20HSBC/About%20 
HSBC/Corporate%20Information/Corporate%20Facts/hnah_factsheet_09 1 1 .pdf . 

14 "HSBC Bank USA, National Association Fact Sheet," at 1, 

http://www.us.hsbc.eom/l/PA_l_083Q9FJ08A002FBP5S00000000/content/usshared/Inside%20HSBC/About%20 
HSBC/Corporate%20Information/Corporate%20Facts/hbus_factsheet_091 l.pdf (hereinafter "HBUS Fact Sheet"). 

15 Id. 

16 Id. at 2. 
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HSBC Securities is a licensed broker-dealer regulated by the SEC. HSBC Finance 
Corporation, formerly subprime lender Household International, provides credit cards, 
automobile loans, consumer lending, and insurance products, and is overseen by several U.S. 
regulators including the Consumer Financial Protection Bureau. 

HNAH also owns an Edge Act corporation in Miami, HSBC Private Bank 
International. 7 The Edge Act allows U.S. national banks to form U.S. subsidiaries designed to 
engage solely in international banking operations, including holding deposits for non-U. S. 
persons. Edge Act corporations are chartered and regulated by the Federal Reserve. In 
addition, HNAH sponsors the HSBC Latin American International Center, also referred to as 
"HSBC Miami Offshore," in Miami. This center, like HSBC Private Bank International, is 
designed to help meet the needs of Latin American clients with banking needs in the United 
States. 19 



HNAH owns several other subsidiaries as well, including HSBC Trust Company, N.A., 
of Delaware, and HSBC Bank Nevada, N.A., of Las Vegas Nevada. 

HBUS Major Lines of Business. HBUS has six major lines of business in the United 

20 

States. The first is "Retail Banking and Wealth Management" which provides deposits, 
checking, savings, mortgages, loans, brokerage products, and certificates of deposit ("CDs") to 

21 

customers. HSBC Premier is a product within the retail bank that provides services for more 
affluent clients. 22 



The HBUS "Private Banking" offers wealth management services for high net worth 
individuals and families with deposits of at least $1 million. 23 HSBC Private Bank provides 
banking, investment, custody, wealth planning, trust and fiduciary, insurance, and philanthropic 

24 

advisory services to its customers. Clients receive a dedicated "relationship manager" to 
manage their Private Bank accounts. 25 

The HBUS "Commercial Banking" offers global banking services to financial 
institutions, companies, governmental entities, and non-profit organizations worldwide. These 
services include deposits, checking, remote deposit capture, payments and cash management, 
pouch services, corporate loans and financing, merchant services, and insurance products. 
HBUS assigns each client a dedicated relationship manager to handle its accounts. 27 



17 See "FAQs - HSBC Money Laundering Enforcement Action," attached to 10/6/2010 email from OCC James 
Vivenzio to OCC colleagues, "HSBC FAQs," OCC-PSI-00898845-857. 

18 See the Edge Act, P.L. 102-242 (1919), codified at 12 U.S.C. § 611 et seq. 

19 See HSBC Latin American International Center website, https://www.us.hsbc.com/l/2/3/hsbcpremier/miami- 
off shore. 

20 HBUS Fact Sheet at 1-2. According to the OCC, HBUS has a total of 32 lines of business altogether. 
Subcommittee interviews of OCC examiners Joe Boss and Elsa de la Garza, January 30, 2012 and January 9, 2012. 

21 See https://www.us.hsbc.eom/l/2/3/hsbcpremier/miami-offshoreretail. 

22 HBUS Fact Sheet at 1. 

23 Id. at 2; Subcommittee interview of HSBC representatives (6/9/2011). 

24 HBUS Fact Sheet at 2. 

25 Need cite 

26 HBUS Fact Sheet at 1. 
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The HBUS "Global Banking and Markets" line of business, with offices in more than 60 
countries, provides a wide range of "tailored financial solutions" to major government, 
corporate, and institutional clients. 28 This line of business includes an extensive network of 
correspondent banking relationships, in which HBUS provides banks from other countries with 
U.S. dollar accounts to transact business in the United States. Due to its affiliates in over 80 
countries, HSBC is one of the largest providers of correspondent banking services in the world. 
In 2010, it had about 2400 correspondent customers, including for more than 80 HSBC 
affiliates. 29 Among other services, HSBC provides financial institution clients with access to the 
U.S. financial system by handling international wire transfers, clearing a variety of U.S. dollar 
instruments, including travelers cheques and money orders, and providing foreign exchange 
services. HBUS Payment and Cash Management (PCM) is a key banking division, located in 
New York, that supports HBUS' correspondent relationships. 

In addition, as part of this line of business, until 2010, HBUS housed the Global 
Banknotes Department, which used offices in New York City, London, Hong Kong, and 
elsewhere to buy, sell, and ship large amounts of physical U.S. dollars. 31 The Banknotes 
Department derived its income from the trading, transportation, and storage of bulk cash, doing 
business primarily with other banks and currency exchange businesses, but also with HSBC 
affiliates. In addition, for a number of years, HBUS held a contract with the U.S. Federal 
Reserve Bank of New York (FRBNY) to operate U.S. currency vaults in several cities around the 
world to assist in the physical distribution of U.S. dollars to central banks, large commercial 
banks, and businesses involved with currency exchange. 33 In June 2010, however, HBUS exited 
the wholesale U.S. banknotes line of business, later selling portions of the business to other 
banks. 34 It also did not renew its contract to operate FRBNY currency vaults. 

The HBUS "Global Asset Management" line of business offers worldwide investment 
management services to clients, and currently manages nearly $400 billion in assets. 35 It is one 
of the largest investment businesses in the world. Finally, "HSBC Insurance" provides a wide 
variety of insurance products to customers in the United States and Canada. 36 

In addition to these major lines of business, in recent years, HBUS has become a leader in 
providing banking services to foreign embassies with a presence in the United States. HBUS 



28 HBUS Fact Sheet at 2. 

29 See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/ Anti-Money Laundering 
('BSA/AML') Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335- 
365, at 7. [Sealed Exhibit.] Subcommittee briefing by HSBC legal counsel (6/20/2012). 

30 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering ('BSA/AML') 
Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335-365, at 341-342 
[Sealed Exhibit.]; Subcommittee interview of Michael Gallagher (6/13/2012). 

31 See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, OCC-PSI-00864335-365, at 341-342. [Sealed Exhibit.] 

32 Id. at OCC-PSI-00864342. 

33 See Form 10-Q filed by HSBC USA Inc. with the SEC for the quarter ending June 30, 201 1, at 9-10. 

34 Id. In 2010, HSBC Holdings pic sold its U.S. wholesale banknotes business in Asia to United Overseas Bank 
Limited (UOB) for $1 1 million, and in 201 1, sold its European banknotes business to HSBC Bank pic. It recorded 
total closure costs of $14 million during 2010. Id. 

35 HBUS Fact Sheet at 2. 

36 Id. at 2. 
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began this business after Riggs Bank and Wachovia Bank stopped providing those services in 
2005, and embassies began looking for a new financial institution. 7 

Through its correspondent banking and Payments and Cash Management (PCM) 
businesses, HBUS has become one of the largest facilitators of cash transfers in the world. 
Between 2005 and 2009, the total number of PCM wire transactions at HBUS grew from 20.4 
million to 30.2 million transfers per year, with a total annual dollar volume that climbed from 
$62.4 trillion to $94.5 trillion. 38 In 2008, HBUS processed about 600,000 wire transfers per 
week/* In 2009, PCM was the third largest participant in the CHIPS wire transfer service which 
provides over 95% of U.S. dollar wire transfers across U.S. borders and nearly half of all wire 
transfers within the United States, totaling $1.5 trillion per day and over $400 trillion in 201 1. 40 

HSBC Affiliates. HSBC has hundreds of affiliates located in over 80 countries. At least 
80 HSBC affiliates have turned to HBUS for access to U.S. dollars and the U.S. financial system. 
These affiliates typically interact with HBUS by opening a correspondent account at HBUS 
headquarters in New York. Many use the account to clear U.S. dollars wire transfers; some use 
the account to cash U.S. dollar instruments like travelers cheques or money orders; still others 
use the account for foreign exchange purposes. In addition, some opened a separate account to 
buy or sell physical U.S. dollars as part of HBUS' wholesale banknotes business, until it was 
shuttered in 2010. 



HSBC affiliates have accounted for a large portion of HBUS' U.S. dollar activities. In 
2009, for example, HSBC determined that "HSBC Group affiliates clear[ed] virtually all USD 
[U.S. dollar] payments through accounts held at HBUS, representing 63% of all USD payments 
processed by HBUS." 41 HSBC also calculated that, over an eight-year period, its U.S. dollar 
clearing business had increased over 200%, from processing an average daily amount of $185 
billion in 2001, to $377 billion in 2009. 42 HBUS also executes transactions through HSBC 
affiliates in other countries. It has been estimated that, in 2009, HBUS processed 19.4 million 
transactions, involving $45.9 trillion, through HSBC affiliates. 43 

One of the largest HSBC affiliates is The Hongkong Shanghai Banking 
Corporation Ltd., which is incorporated in Hong Kong and is Hong Kong's largest 



37 See 1/30/2006 OCC Supervisory Letter regarding HBUS Embassy Banking, OCC-PSI-00107529-736, at 529-530; 
"HSBC to Open D.C. Branch, Pursue Embassy Clients," Washington Post, Terence O'Hara (10/5/2004)(quoting 
Riggs spokesperson: "As a service to our remaining embassy clients, Riggs is working closely with HSBC to ensure 
a smooth transition."), http://www. washingtonpost.com/ac2/wp-dyn/ A7285-2004Oct4?language=printer. 

38 See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering 
('BSA/AML') Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335- 
365, at 7. [Sealed Exhibit.] 

39 7/28/2008 OCC memorandum, "OF AC Examination - Payment and Cash Management (PCM)," OCC-PSI- 
01274962, at 4. [Sealed Exhibit.] 

40 Id. See also The Clearing House website, "About CHIPS," http://www.chips.org/about/pages/033738.php. 

41 See 9/9/2009 chart entitled, "HSBC Profile," included in "HSBC OF AC Compliance Program," a presentation 
prepared by HSBC and provided to the OCC, at HSBC OCC 8874197. 

42 Id. at "USD Payment Statistics - Fact Sheet," HSBC OCC 887421 1. 

43 See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/ Anti-Money Laundering 
('BSA/AML') Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335- 
365, at 7. [Sealed Exhibit.] 
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bank. Established in 1865, when Hong Kong was part of the British empire, it is the 
founding member of the HSBC Group, but now operates as a subsidiary of HSBC 
Holdings pic, the Group's parent corporation. With more than 71,400 employees, it 
oversees a network of hundreds of HSBC affiliates in 20 countries throughout Asia and 
the Pacific Region, including Australia, Bangladesh, China, India, Japan, Malaysia, New 
Zealand, Thailand, and Vietnam. 45 It is sometimes referred to in internal HSBC 
documents as HBAP, an abbreviation for HSBC Bank Asia Pacific. 

A second key affiliate is HSBC Bank Middle East Ltd. (HBME). Incorporated in 
Jersey in the Channel Islands and owned through a chain of subsidiaries reaching back to 
the Group's parent corporation in London, HBME oversees a network of financial 
institutions throughout the Middle East and North Africa. 46 With more than 5,000 
employees, HBME provides banking services through nearly 45 branches in Algeria, 
Bahrain, Jordan, Kuwait, Lebanon, Oman, Pakistan, Qatar, and the United Arab 
Emirates. 47 In 1998, HSCB Group established "HSBC Amanah," a "global Islamic 
financial services division" designed to "serve the particular needs of Muslim 

48 

communities" in compliance with Islamic law. HBME offers Amanah banking 
services to many of its clients in the Middle East and North Africa. 

A third affiliate discussed in this Report is HSBC Mexico S.A. Banco (HBMX), the 
principal operating company of Grupo Financiero HSBC, S.A. de C.V., which owns HSBC's 
businesses in Mexico. HSBC's Mexican group is one of Mexico's largest financial service 
conglomerates, with over 1,000 branches throughout the country, nearly $2 billion in assets, and 
over 8 million clients. 49 HSBC purchased HBMX in 2002, when it operated under the name of 
Banco Internacional, S.A. and was part of Grupo Financiero Bital, S.A. de C.V. 50 HBMX and its 
Mexican parent are headquartered in Mexico City and together have about 19,000 employees. 51 



See "Hongkong Shanghai Banking Corporation Limited Annual Report and Accounts 201 1," at 2, 
http://www.hsbc. com. hk/l/PA_l_3_S5/content/about/financial-information/financial- 
reports/bank/pdf/201 lreport.pdf. 

45 Id. 

46 See "HSBC Bank Middle East Limited Annual Report and Accounts 201 1," 

http://www.hsbc.ae/l/PA_l_083Q9FJ08A002FBP5S00000000/content/uae_pws/pdf/en/annual_report_2011.pdf. 

47 See id. at 32. See also "HSBC Wins its Eighth Best Cash Management Bank in the Middle East Award," 
http://www.hsbc. ae/l/2/about-hsbc/newsroom/eighth-best-cash-management, viewed 4/2/12; "HSBC Research 
Picks Up More Regional Awards," (1/12/12), 

http://www.hsbc.ae/l/PA_l_083Q9FJ08A002FBP5S00000000/content/uae_pws/pdf/en/newsroom/euromoney- 
research-awards-jan-12.pdf, viewed 4/12/12. HSBC provides banking services in Saudi Arabia through both HSBC 
Saudi Arabia, in which it is a 49% shareholder, and Saudi British Bank (SABB), in which it is a 40% shareholder. 
See "HSBC Research Picks Up More Regional Awards," (1/12/12), 

http://www.hsbc.ae/l/PA_l_083Q9FJ08A002FBP5S00000000/content/uae_pws/pdf/en/newsroom/euromoney- 
research-awards-jan-12.pdf, viewed 4/12/12. 

48 See HSBC website, "About HSBC Amanah," http://www.hsbcamanah.com/amanah/about-amanah. 

49 See HSBC website, Grupo HSBC Mexico, http://www.hsbc. com.mx/l/2/grupo, viewed 4/2/12. 

50 "HSBC Consuma la Adquision de GF BITAL," (1 1/25/02), 

http://www.hsbc. com. mx/l/PA_l_l_S5/content/home_en/investor_relations/press_releases/infpress/hsbc_consuma. 
pdf. 

51 See HSBC website, Grupo HSBC Mexico, http://www.hsbc. com.mx/l/2/grupo, viewed 4/2/12. 
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HSBC Leadership. Over the last few years, HSBC leadership has undergone significant 
change. In 2010, HSBC Holdings pic appointed a new Chairman of the Board of Directors, 
Douglas J. Flint, replacing Stephen Green, who had become a U.K. Cabinet Minister. 52 A new 
Group Chief Executive was also selected, replacing Michael Geoghegan, who retired, with Stuart 
T. Gulliver. In 2012, HSBC Holdings pic also appointed a new Chief Legal Officer, Stuart 
Levey, former Undersecretary for Terrorism and Financial Intelligence at the U.S. Treasury 
Department. Mr. Levey replaced the Group's General Counsel, Richard Bennett. 53 

Also in 2010, Sandy Flockhart, became Chairman of Europe, Middle East, Africa, Latin 
America, Commercial Banking; as well as Chairman of HSBC Bank pic. 54 Mr. Flockhart, who 
first joined HSBC in 1974, is an emerging markets specialist and, among other posts, headed 
HBMX in Mexico for five years, from 2002 to 2007. 55 He was also appointed to the HSBC 
Group Board of Directors in 2008, and became a director of HSBC Bank Middle East in July 
2011. 56 



HNAH Leadership. At HNAH, the U.S. bank holding company, the persons holding 
leadership positions have often overlapped with those of HNAH's key subsidiaries, HBUS, 
HSBC Securities, and HSBC Finance Corporation. HNAH's current Chief Executive Officer 

57 

(CEO), for example, is Irene Dorner, who is also the CEO of HBUS. Her immediate 
predecessor at HNAH, for less than a year, was Niall Booker, who was preceded by Brendan 
McDonagh, former Chief Operating Officer (COO) of HBUS. Before Mr. McDonagh, HNAH 
was headed by Siddharth ("Bobby") N. Mehta, who was also head of HSBC Finance 
Corporation, but left the bank when HSBC Finance Corporation's subprime mortgage portfolio 
incurred huge losses during the recent financial crisis. 

The current HNAH COO is Gregory Zeeman; the current General Counsel is Stuart 
Alderoty; and the current Chief Auditor is Mark Martinelli, each of whom currently holds the 

58 

same position at HBUS. HNAH's Chief Risk Officer is Mark Gunton who holds the same 
position at both HBUS and HSBC Finance Corporation. 

HBUS Leadership. Over the last ten years, HBUS has undergone numerous changes in 
leadership, with the head of the bank turning over four times. 59 The current head is Irene Dorner 



See "HSBC Announces New Leadership Team," (9/24/10), media release prepared by HSBC, 
http://www.hsbc.eom/l/2/newsroom/news/2010/hsbc-announces-new-leadership. 

53 "HSBC appoints Chief Legal Officer," (1/13/12), media release prepared by HSBC, 

http://www.hsbc.eom/l/2/newsroom/news/2012/chief-legal-officer. Mr. Levey held his position at the Treasury 
Department from July 2004 to February 201 1. Id. Mr. Bennett had headed HSBC Group's Legal and Compliance 
department since 1998; in 2010, he had become General Counsel. 

54 54 See "HSBC Announces New Leadership Team," (9/24/10), media release prepared by HSBC, 
http://www.hsbc.eom/l/2/newsroom/news/2010/hsbc-announces-new-leadership. 

55 See HSBC Group "Board of Directors," http://www.hsbc.eom/l/2/about/board-of-directors (describing Mr. 
Flockhart as "a career banker, being an emerging markets specialist with over 35 years' experience with HSBC in 
Latin America, the Middle East, US and Asia"); interview??. 

56 Id. 

57 See "Leadership: HSBC North America Holdings Inc.," 

https://www.us.hsbc.eom/l/2/3/personal/inside/about/corporate-information/leadership/hnah. 

58 Id. 

59 Information on HBUS' leadership is taken from its SEC annual reports. 
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who serves as HBUS' Chairman of the Board, President, and CEO. She was appointed to those 
positions in 2010, after having served as the CEO of HSBC Bank Malaysia and as a director on 
the HBUS Board. Her immediate predecessor was Paul J. Lawrence who headed HBUS from 
2007 to 2010. His predecessor was Sandy L. Derickson who served in the post for less than one 
year and left the bank along with Mr. Mehta after HSBC Finance Corporation, where he was 
second-in-command, incurred substantial losses. His predecessor was Martin J.G. Glynn who 
headed HBUS from 2003 to 2006, and then retired. 

HBUS has a six-person Board of Directors. Its current members are Ms. Dorner; William 
R.P. Dalton, former CEO of HSBC Bank pic in London; Anthea Disney, former Executive Vice 
President of NewsCorporation; Robert Herdman former SEC Chief Accountant; Louis 
Hernandez, Jr., CEO of Open Solutions Inc.; and Richard A. Jalkut, CEO of TelePacific 
Communications . 

Within HBUS, the current Chief Operating Officer (COO) is Gregory Zeeman. 60 His 
immediate predecessor was David Dew 1 who was preceded by Brendan McDonagh, who served 
as the COO from 2004 to 2006. Some other key HBUS executives are Marlon Young, the head 
of Private Banking Americas; Kevin Martin, the head of Retail Banking and Wealth 
Management; and Mark Watkinson, the head of Commercial Banking. 62 Since 2007, the bank's 
Chief Auditor has been Mark Martinelli. From 2000 to 201 1, the head of HBUS Payments and 
Cash Management (PCM) was Michael Gallagher. The head of Global Banknotes, from 2001 to 
2010, was Christopher Lok. 

HBUS' current General Counsel is Stuart A. Alderoty. 63 His predecessor was Janet 
Burak who served as the bank's General Counsel from 2004 to 2010. In 2007, she was also 
made the Regional Compliance Officer for North America. 64 

B. HBUS AML Program 

The compliance and anti-money laundering (AML) programs at HBUS have undergone 
continual organizational and leadership changes since 2005. In April 2003, the Federal Reserve 
and New York State Banking Department, which oversaw HBUS' predecessor bank, cited the 
bank for multiple, severe AML deficiencies and required it to enter into a written agreement to 



See "Leadership: HSBC Bank USA, N.A.," https://www.us.hsbc.com/l/2/3/personal/inside/about/corporate- 
information/leadership/hbus . 

61 Mr. Dew served as HBUS COO from March 2007 to 2008; prior to that, he served for a month as HBUS Chief 
Administrative Officer from February 2007 to March 2007; prior to that he served as audit head at HUSI and HSBC 
North America Inc from 2006 to 2007, and as Audit head of HSBC North America Holdings Inc. from 2004 to 
2007. Mr. Dew currently works as Managing Director of the Saudi British Bank which is 40% owned by HSBC. 
Subcommittee interview of David Dew (3/5/2012). 

62 "2011 HSBC Annual Report," http://www.us.hsbc.com/l/2/3/personal/inside/about/corporate- 
information/leadership/hbus, viewed 3/23/12. 

63 See "Leadership: HSBC Bank USA, N.A.," https://www.us.hsbc.com/l/2/3/personal/inside/about/corporate- 
information/leadership/hbus . 

64 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") 
Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00000230-259, at 256. 
[Sealed Exhibit.] 
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revamp and strengthen its AML program. It was at that time that HBUS renamed itself and 
converted to a national bank charter under the supervision of the OCC. During its first year 
under OCC supervision, HBUS reorganized its AML program, revamping its AML controls, 
country and client risk assessment criteria, Know-Your-Customer (KYC) due diligence 
requirements, and systems for detecting and reporting suspicious activity. 66 HBUS also acquired 
a new system for monitoring account activity, called the Customer Activity Monitoring Program 
(CAMP) and established criteria to produce alerts requiring additional reviews. In addition, 
HBUS created a system of KYC client profiles with standard due diligence information 
requirements for each client and which was updated on a regular basis and had to be approved by 
compliance and other bank officials for an account to be kept open. HBUS also established a 
Financial Intelligence Group to conduct enhanced due diligence reviews. 

Although the OCC gave positive reviews to the bank's initial efforts, by 2010, the OCC 
issued a lengthy Supervisory Letter again citing the bank for numerous AML deficiencies and 
requiring HBUS to revamp its AML program a second time. In response, the bank issued an 
action plan to correct identified problems. HBUS has, for example, acquired a new AML 
monitoring system, NORKOM to replace CAMP, and is working to refine its parameters for 
detecting suspicious activity. In its first month of operation, NORKOM detected more than 
100,000 transactions needing further review, demonstrating its ability to catch many transactions 
that went previously unchecked under CAMP. 

HBUS has also revamped its approach to HSBC affiliates, which make up an important 
segment of HBUS' correspondent banking, wire transfer, and cash management businesses and 
previously operated without due diligence controls and at times with minimal or no AML 
monitoring. Among other changes, HBUS now requires all subsidiaries to conduct due diligence 
on all other HSBC affiliates, including by using internal audit information identifying their AML 
risks and AML controls; identifies affiliates posing high AML risks and treat them accordingly, 
thus ending all policies exempting affiliates from standard AML account and wire transfer 
monitoring. In addition, HBUS has revamped its country and client risk assessment criteria, 
which now identifies high risk clients in a more robust manner; reviewed its correspondent 
banking business to reduce the number of high risk financial institutions; and closed some high 
risk business lines including its U.S. banknotes program. HBUS has also hired new AML 
leadership and significantly expanded its AML staffing and resources. HBUS currently employs 
over 1,000 compliance personnel. 68 

Some of HBUS' changes have been criticized by the OCC as inadequate. HBUS has 
been informed by the OCC that it must do additional work on its monitoring system in order to 
implement the requirements of the 2010 Cease and Desist Order. The individual hired by HBUS 
to serve as its Chief Compliance Officer was asked to leave by the bank shortly after starting in 



See HSBC Bank USA, Federal Reserve Bank of New York, and New York State Banking Department , Docket 
No. 03-012-WA/RB-SM (Board of Governors of the Federal Reserve System, Washington, D.C.), Written 
Agreement (4/30/2003), OCC-PSI-00907803-8 11. 

66 See OCC Report of Examination of HBUS, for the examination cycle ending March 31, 2005, OCC-PSI- 
00423650. [Sealed Exhibit.] 

67 Id. at 10-11 (describing the formal agreement). 

68 See 7/10/2012 HSBC Group News, "HSBC to Testify at U.S. Senate Hearing." letter by HSBC Group Chief 
Executive Stuart Gulliver, PSI-HSBC-76-000 1-002, at 002. 
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2010. Both HBUS and the OCC will have to work hard to ensure that the latest round of changes 
will produce a better AML outcome than the changes made in 2004. 

(1) HBUS Compliance and AML Leadership 

Over the last five years, HBUS has experienced high turnover in its Compliance and 
AML leadership, making reforms difficult to implement. Since 2007, HBUS has had four 
Compliance heads and five AML directors. Currently, both positions are held by the same 
person, Gary Peterson. Mr. Peterson has extensive AML experience and was hired in 2010, to be 
the AML director, but after the Compliance head was asked to leave in 2010, has since held both 
posts. In 2012, Mr. Peterson is expected to relinquish his duties as AML director to his deputy, 
Alan Schienberg, so that the top Compliance and AML positions at HBUS will each have a full 
time professional. 69 

The top compliance position at HBUS is the Chief Compliance Officer who oversees all 
compliance issues for the bank. In the AML field, HBUS has specified two posts which have 
been held by the same person, the Anti-Money Laundering (AML) Directorwho is tasked with 
ensuring bank compliance with U.S. AML laws and regulatory requirements. HBUS' 
Compliance and AML leadership positions were relatively stable until 2007, after which the 
bank has struggled to hire and retain experienced compliance professionals. 

HBUS' Chief Compliance Officer from 2000 to 2007 was Carolyn Wind. Prior to that 
position, Ms. Wind worked for Republic Bank of New York as a compliance officer and, before 
that, as an OCC bank examiner. For the first three years she held the job, Ms. Wind also served 
as the AML Director. In 2003, the bank hired a separate AML Director, Teresa Pesce, who 
served in that post for four years, from 2003 to 2007. Before taking the position at the bank, Ms. 
Pesce was a federal prosecutor with the U.S. Attorney's office in New York. Ms. Pesce left the 
bank in 2007, after which Ms. Wind headed both the Compliance and AML Compliance 
functions until she left the bank later in 2007. As discussed below, Ms. Wind was dismissed by 
HBUS after raising the issue of inadequate AML resources with the audit committee of the board 
of directors of the bank's holding company, HNAH. 

In 2007, as part of a "Compliance Transformation Initiative," HSBC established a North 
America Compliance department at HNAH headed by a Regional Compliance Officer. 71 HNAH 
appointed Janet Burak, then Regional Legal Department Head for North America, to also serve 

72 

as the Regional Compliance Officer; she held both positions from 2007 to 2010. At the time, 
HSBC Group Compliance head David Bagley expressed concern about combining the two roles, 
arguing that each required too much effort for a single person, but was overruled. 73 Two years 



69 See HSBC website, "Leadership: HSBC Bank USA, N.A.," 

https://www.us.hsbc.eom/l/2/3/personal/inside/about/corporate-information/leadership/hbus. 

70 The AML Director also serves as HBUS' Bank Secrecy Act Compliance Officer. 

71 See also Federal Reserve, at BOG-A-205485. 

72 See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/ Anti-Money Laundering 
('BSA/AML') Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335- 
365, at 27. [Sealed Exhibit.] 

73 See 6/21/2007 email from HSBC David Bagley to HSBC Richard Bennett, HSBC OCC 8873871-5 (conveying to 
HSBC Group's most senior legal counsel, Richard Bennett, the concern of HBUS compliance personnel about "the 
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later, in March 2009, the Federal Reserve issued a negative critique of Ms. Burak's performance, 
noting in particular that she did not have an adequate understanding of AML risk or controls. 74 
The OCC also later criticized her performance as well as the decision to combine the regional 
legal and compliance roles, noting in 2010, that Ms. Burak "has had to balance a wide range of 
legal and compliance duties, including establishing the strategic direction for both functions and 

75 

representing both functions on senior committees at the Group level." The OCC stated that, as 
a consequence, Ms. Burak had "not regularly attended key committee or compliance department 
meetings" and had failed to keep herself and other bank executives "fully informed about issues 
and risks within the BSA/AML compliance program." It also placed some of the blame at her 
feet for a recently discovered backlog of 17,700 alerts indicating possible suspicious activity at 
the bank, which had not been reviewed, noting that "[b]acklogged alerts needed to receive the 
highest level of attention from senior bank management at a much earlier stage to ameliorate the 

77 

problem." Soon after this critique, Ms. Burak left the bank. 

In the two years she held the regional posts, Ms. Burak oversaw three functional 
compliance teams at HNAH called "Compliance Advisory," "Compliance Center of Excellence," 
and "Compliance Shared Services Utility." 78 Each team was headed by a senior Compliance 
manager: Curt Cunningham, Anthony Gibbs, and Lesley Midzain. 

Ms. Midzain was hired in 2007 to replace Carolyn Wind and so worked, not only for 
HNAH, but also for HBUS as both its Compliance head and AML director. She held these 
compliance posts for two years, from 2007 until 2009. Prior to being placed at the helm of the 
bank's AML program, Ms. Midzain had no professional experience and little familiarity with 
U.S. AML laws. In December 2008, HNAH's regulator, the Federal Reserve, provided a 
negative critique of Ms. Midzain' s management of the bank's AML program. The Federal 
Reserve wrote that Ms. Midzain did "not possess the technical knowledge or industry experience 



capability of one person to manage a very large legal function and a compliance function" and that "compliance 
will be pushed down below Legal"). See also 7/28/2010 email from HSBC David Bagley to HSBC Michael 
Geoghegan, HSBC OCC 8873871-75 (expressing to HSBC CEO Michael Geoghegan, that with regard to the 2007 
decision to combine the two roles into one: "I fully accepted that Brendan [McDonagh], Paul [Lawrence] and 
Richard [Bennett] had the right to make this call, although as I said to you in Vancouver I now wish I had been more 
vociferous and in the current way my role operates I am confident that I would have a far stronger say."). 

74 The March 2009 Federal Reserve's Summary of Ratings stated: "Interviews conducted as part of our recent 
governance review revealed that Janet Burak, HNAH Legal and Compliance chief risk officer has only broad 
understanding of BSA/AML risk and relies on the HNAH BSA/AML officer [Midzain] to manage the risk. . . . 
Midzain, as previously stated has weak BSA/AML knowledge and industry experience. Burak's heavy reliance on 
the inexperienced Midzain is a concern. An example of Burak's limited management oversight of BSA/AML was 
revealed when we recently met with her to clarify a few items from our Governance review she was unable to 
respond to the question about the distribution and the purpose of annual AML statements. She subsequently 
communicated via email that she does not review the annual AML statements provided to her by the 
HNAH/BS A/ AML officer (Midzain). Burak forwards the statements to Group." 3/25/2009 "Summary of Ratings 
for HSBC North America Holdings," Federal Reserve Bank of Chicago, OCC-PSI-00899234. 

75 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/ Anti-Money Laundering ('BSA/AML') 
Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335-365, at 27. 
[Sealed Exhibit.] 

76 Id. 

77 Id. 

78 Id. See also Federal Reserve, at BOG-A-205485. 
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to continue as the BSA/AML officer." It noted that she "was interviewed by OCC examiners 
from another team and they supported the conclusion of the OCC resident staff that Midzain's 
knowledge and experience with BSA/AML risk is not commensurate to HNAH's BSA/AML 
high risk profile, especially when compared to other large national banks." 80 

In 2009, the OCC also concluded that Ms. Midzain did not have the requisite AML 
expertise for her position. An OCC Supervisory Letter echoed the criticisms leveled earlier by 
the Federal Reserve: 

"Ms. Midzain was selected as the Compliance Director and BSA Officer although she 
does not have the qualifications or the experience to manage a BSA program at an 
institution with the size and amount of BSA compliance risk that HBUS has. She is a 
Canadian lawyer (a barrister and solicitor) who formerly worked for HNAH. She is also 
a member of Group's executive development program. . . . Ms. Midzain's assignment as 
HBUS' BSA Officer and Compliance Director has been her first assignment outside of 
Canada as a part of that program. . . . During its 2009 compliance management 
examination, the OCC determined that Ms. Midzain lacked the experience and expertise 
to be the BSA Officer, and the OCC included an MRA in its supervisory letter that 
required the bank to strengthen is BSA/AML compliance leadership by hiring a BSA 
Officer who is highly qualified and very experienced." 81 

In response to the Federal Reserve and OCC criticisms, HBUS removed Ms. Midzain 
from the AML post, but retained her as head of HBUS' Compliance department. In the fall of 
2009, HBUS hired a new AML Director, Wyndham Clark, a former U.S. Treasury official, who 
assumed the post in the middle of an intensifying AML examination by the OCC and a host of 
serious AML problems facing the bank. Mr. Clark was required to report to Curt Cunningham, 
an HBUS Compliance official who freely admitted having no AML expertise, and through him 
to Ms. Midzain, whom the OCC had also found to lack AML expertise. Shortly after he arrived, 
Mr. Clark began requesting additional resources. 83 After 30 days at the bank, Mr. Clark sent Mr. 
Cunningham a brief memorandum with his observations, noting that HBUS had an "extremely 
high risk business model from AML perspective," had seen recent high turnover in its AML 
directors, and granted only limited authority to the AML director to remedy problems: 

"AML Director has the responsibility for AML compliance, but very little control over 
its success. 



Federal Reserve Bank of Chicago Summary of Ratings for HSBC North America Holdings, March 25, 2009, 
OCC-PSI-00899234. 

80 Id. 

81 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering ('BSA/AML') 
Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335-365, at 28. 
[Sealed Exhibit.] 

82 Id. at 28. 

83 See, e.g., 10/19/2009 email exchange between HBUS Wyndham Clark and HBUS Debra Bonosconi, "OFAC 
resources," OCC-PSI-00 162661 (Mr. Clark commented after Janet Burak had recently approved three new 
compliance personnel positions, "Clearly a positive, although I understand that these were requested quite a while 
ago. I hope that isn't the typical response time." Ms. Bonosconi responded: "Oh, this was express time. Trust me 
on that. Usually the response is 'no.'"). 
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Operate under 'crisis' mode, actions are reactive rather than forward thinking. 

AML Director unable to manage at high level. 

Several AML Directors/BSA Officers in a short period of time." 

As he continued his work, Mr. Clark grew increasingly concerned that the bank was not 
effectively addressing its AML problems. In February 2010, Mr. Clark met with the Audit 
Committee of the HNAH board of directors and informed the committee that he had never seen a 
bank with as high of an AML risk profile as HBUS. 85 He also informed them that AML 
resources were "insufficient versus current risks and volumes," and the bank's systems and 
controls were "inconsistent with AML risk profile." 86 On May 10, 2010, Mr. Clark wrote to a 
more senior HBUS Compliance official that with regard to the bank' s AML compliance 

87 

program, "With every passing day I become more concerned. . .if that's even possible." 

In July 2010, less than a year after taking the post, Mr. Clark decided to resign. He sent 
an email to the head of HSBC Group Compliance David Bagley explaining that he did not have 
the authority or support from senior compliance managers needed to do his job as AML director: 

"[T]he bank has not provided me the proper authority or reporting structure that is 
necessary for the responsibility and liability that this position holds, thereby impairing 
my ability to direct and manage the AML program effectively. This has resulted in most 
of the critical decisions in Compliance and AML being made by senior Management who 
have minimal expertise in compliance, AML or our regulatory environment, or for that 
matter, knowledge of the bank (HBUS) where most of our AML risk resides. Until we 
appoint senior compliance management that have the requisite knowledge and skills in 
these areas, reduce our current reliance on consultants to fill our knowledge gap, and 
provide the AML Director appropriate authority, we will continue to have limited 
credibility with the regulators." 88 

When asked about his experience at the bank, Mr. Clark told the Subcommittee that he did not 
have either the authority or resources needed as AML director. After his departure, the bank 
hired Gary Peterson, who was then an AML consultant to the bank, appointing him as HBUS' 
new AML director. 



10/15/2009 HBUS memorandum from Wyndham Clark to HNAH Curt Cunningham, "30 Day Observations and 
Recommendations Report from AML Director," HSBC PSI PROD 0065332. 

85 Subcommittee interview of Wyn Clark (11/30/2011); 2/17/2010 "HNAH AML Program, Board Audit Committee 
Presentation," by HBUS Wyndham Clark to the Audit Committee of the HNAH board of directors, HSBC OCC 
3900290. 

86 2/17/2010 "HNAH AML Program, Board Audit Committee Presentation," by HBUS Wyndham Clark to the 
Audit Committee of the HNAH board of directors, HSBC OCC 3900290. 

87 5/10/2010 email from HBUS Wyndham Clark to HBUS Anne Liddy, "AML Townhall," OCC-PSI-00672582. 
See also 5/9/2010 email from HBUS Wyndham Clark to HNAH Curt Cunningham, "AML Townhall," OCC-PSI- 
00672571 ("Essentially AML decisions are now being made without AML SME [subject matter expertise]. This 
will be very apparent to the regulators."). 

88 7/14/2010 email from HBUS Wyndham Clark to HSBC David Bagley, OCC-PSI-00676731. Mr. Clark formally 
left the bank in August 2010. Subcommittee interview of Wyndham Clark (1 1/30/201 1). 

89 Subcommittee interview of Wyndham Clark (1 1/30/201 1). Mr. Clark told the Subcommittee that, prior to his 
leaving, the bank finally approved a number of new AML hires. Id. 



25 



Around the same time that Mr. Clark left the bank in 2010, Ms. Midzain also departed, 
leaving open the post of Chief Compliance Officer. That post remained vacant until 201 1, when 
HBUS hired Eric Larson. He left after fifteen months on the job. 90 HBUS then asked Gary 
Peterson to serve, not only as HBUS' AML Director, but also as its Compliance head, and as 
HNAH's Regional Compliance Officer following Ms. Burak's departure in 2010. Mr. Peterson 
agreed and has served in all three posts since 2010. Altogether, these personnel changes meant 
that, over the last five years, HBUS has had four Chief Compliance Officers and five AML 
Directors. 

At HSBC Group, HBUS' parent organization, for nearly ten years, from 2002 to the 
present, David Bagley has served as the HSBC Group's head of Compliance. He is located in 
London and oversees both general and AML compliance issues. His second-in-command is 
Warren Learning, Deputy Head of HSBC Group Compliance, who has been in that position since 
January 1, 2007. Susan Wright serves as the head of HSBC's AML efforts. She is also located 
in London and has served in that position for more than a decade. John Root is a senior Group 
Compliance officer who has concentrated on compliance and AML issues in Mexico and Latin 
America. Compliance personnel work with Matthew King who has served as the head of HSBC 
Group Audit since 2002. 

(2) HBUS AML Program 

Federal law requires banks operating in the United States to have a minimum of four 
elements, an AML compliance officer in charge of the program, AML internal controls, AML 
training, and an independent testing of the AML program to ensure its effectiveness. 91 HBUS' 
AML program must address a wide range of AML issues, from customer due diligence, to 
monitoring account and wire transfer activity, to reporting suspicious activity to law 
enforcement. It must also cover a wide range of business lines and products, including 
Correspondent Banking, International Private Banking, Domestic Private Banking, Embassy 
Banking, Payment and Cash Management, and Banknotes services. 

Inadequate Staffing. Despite its high AML risks, millions of customers, and 
employment of more than 16,500 employees overall, from 2006 to 2009, HBUS's entire 
Compliance Department numbered less than 200 full time employees; its AML Compliance staff 

92 

was a subset of that and also included staff in India. HBUS personnel told the Subcommittee 
that inadequate AML staffing was one of the biggest problems they faced. OCC examinations 
also routinely identified inadequate staffing as a key AML problem, including with respect to 



Subcommittee interview of OCC Examiner Teresa Tabor (5/17/2012). 

91 See 31 U.S.C. §5318(h); 12 C.F.R. §21.21. 

92 Subcommittee briefing by HSBC legal counsel (6/30/201 1). 

93 Subcommittee interview of HBUS Debra Bonosconi (11/17/2011) (Ms. Bonosconi reported to the Subcommittee 
that staffing was her biggest issue and that by March 2008 it was evident that more staff was needed. She made 
several requests for additional resources); Subcommittee interview of HBUS Anne Liddy (2/22/2012) (Ms. Liddy 
made a request for resources to Carolyn Wind, but was told that there was no appetite to bring on additional staff); 
Subcommittee interview of HBUS Carolyn Wind (3/7/2012); Subcommittee interview of HBUS Teresa Pesce 
(3/30/2012) (Ms. Pesce asked for business to provide funding for more AML Compliance positions because 
Compliance did not have the money). 



26 



unreviewed alerts, PCM processing, Correspondent Banking, OFAC reviews, Embassy 
Banking, 98 and the Compliance Review Unit that tested the bank's AML controls." 

Bank documents show that Compliance and AML staffing levels were kept low for many 
years as part of a cost cutting measure. In 2007, HBUS announced a "1509 Initiative," to 
increase the bank's return on equity by 2009, largely through cost cutting measures. One 
component of the plan was to ensure that 2007 and 2008 headcounts remained flat. This hiring 
freeze caused HBUS Compliance and the AML staffing requests to be denied or unanswered. At 
one point, HBUS Compliance and AML management resorted to requesting temporary staff 
when persistent AML alert backlogs grew to unmanageable levels. In 2007, HBUS fired its 
longtime AML head after she raised resource concerns with the HNAH Audit Committee; an 
AML director hired in 2009 left after being denied the authority and resources he considered 
necessary to do his job. After the OCC issued its lengthy Supervisory Letter criticizing multiple 
aspects of HBUS' AML program, bank management began to significantly increase AML staff 
and resources. 

AML Staffing Problems. In 2006, HBUS Compliance was already struggling to 
"handle the growing monitoring requirements" associated with the bank's correspondent banking 
and cash management programs, and requested additional staff. 100 In October 2006, HBUS 
Compliance officer Alan Ketley wrote that despite having very efficient processes, each month 
his Compliance team was "handling an average of 3,800 [alerts] per person and [was] becoming 
overwhelmed thus potentially placing the business and the bank at risk." 101 Despite requests for 
additional AML staffing, HBUS decided to hold staff levels to a flat headcount. 102 

1509 Initiative and Hiring Freeze. In 2007, against the backdrop of losses stemming 
from its troubled acquisition of Household International and the beginning of the global financial 
crisis, HBUS launched the 1509 Initiative which sought to achieve a 15% return on equity for the 



3/3/2010 OCC Supervisory Letter HSBC-2010-03, "Backlog of Monitoring Alerts and Enhanced Due Diligence 
Requests," OCC-PSI-0085 1542-545. [Sealed Exhibits.] 

95 3/18/2009 OCC Supervisory Letter HSBC-2008-40, "Payment and Cash Management BSA/AML Examination," 
OCC-PSI-00 107624-625. [Sealed Exhibit.] 

96 3/3/2009 OCC Supervisory Letter HSBC-2008-34, "Correspondent Banking BSA/AML Examination," OCC-PSI- 
00 1076 18-620. [Sealed Exhibit] 

97 7/28/2008 OCC memorandum, "OFAC Examination - Payment and Cash Management (PCM)," OCC-PSI- 
01274962; 1/20/2009 OCC Supervisory Letter HSBC-2008-41, "Office of Foreign Asset Control Examination," 
OCC-PSI-00000434-436. [Sealed Exhibits.] 

98 See 3/19/2007 OCC Supervisory Letter HSBC-2006-30, "Government and Institutional Banking BSA/AML 
Examination," OCC-PSI-00 107567-571; 1/30/2006 OCC Supervisory Letter regarding HBUS Embassy Banking, 
OCC-PSI-00107529-536. [Sealed Exhibits.] 

99 See 6/14/2006 OCC Supervisory Letter HSBC-2006-16, "Compliance Review Unit Examination," OCC-PSI- 
00000341-345. [Sealed Exhibit.] 

100 See 10/31/2006 email from HBUS Alan Ketley to HBUS Michael Gallagher, Denise Reilly, and Charles 
DelBusto, "Additional Compliance headcount needed to support PCM," HSBC OCC 0616340-43, at 341. 

101 Id. at HSBC OCC 0616342. 

102 See, e.g., 10/31/2006 email exchange between HBUS Michael Gallagher and HBUS Tony Murphy, Charles 
DelBusto, Alan Ketley, and others, "Additional Compliance headcount needed to support PCM," HSBC OCC 
0616340-343; 9/25/2006 email exchange between HBUS Michael Gallagher and HBUS Teresa Pesce, Alan Ketley, 
Charles DelBusto, and others, "Additional monitoring resources," HSBC OCC 7688655-657. 
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bank by 2009, primarily by cutting costs. One facet of 1509 was the "$100 Million Dollar Cost 
Challenge," which set a goal of cutting costs of $100 million in 2007. 103 

The hiring freeze began in September 2007, when HBUS Compliance had a headcount of 
198 full time employees, one below its December 2006 level. 104 When Compliance sought to fill 
six open positions, David Dew, HBUS Chief Operating Officer (COO), informed Compliance 
head and AML director Carolyn Wind that the positions could not be filled: 

"This increase will be almost impossible to justify and therefore I must ask you to please 

cancel the open positions and ensure that your FTE as at 31 Dec 2007 does not exceed 
1 99 " 105 

To make the case for increased staffing resources, in September 2007, HBUS 
Compliance personnel reached out to compliance peers at other banks and learned that at the 
three major banks that provided some information, each had a greater number of monitoring staff 
in the correspondent banking area than HBUS. 106 In addition, HBUS Compliance personnel 
noted that HBUS Compliance filed many fewer Suspicious Activity Reports ("SARs") than its 
competitors; while HBUS filed three to four per month in the correspondent banking area, its 
peers filed 30 to 75 per month, and one major international bank disclosed that it filed 
approximately 250 SARs per month. 108 Despite these statistics, the Compliance department and 
AML staff remained stagnant. 

Fired After Raising Staffing Concerns to Board. After being turned down for additional 
staff, Carolyn Wind, longtime HBUS Compliance head and AML director, raised the issue of 
inadequate resources with the HNAH board of directors. A month after that board meeting, Ms. 
Wind was fired. 



u " See HSBC internal presentation entitled, "1509," HSBC OCC 0616217-254, at 241-45. 

104 9/14/2007 email from HBUS David Dew to HBUS Carolyn Wind, Janet Burak, and Kathryn Hatem, 
"HEADCOUNT," HSBC OCC 0616262. 

105 Id. 

106 On 9/6/2007, Mr. Ketley wrote: "Every bank that responded and provided information about monitoring staff has 
more than HBUS." 9/6/2007 email from HBUS Alan Ketley to HBUS Alan Williamson, Judy Stoldt, and George 
Tsugranes, "Correspondent survey," HSBC OCC 0616384-385. See also 9/6/2007 HBUS chart, "Correspondent 
Banking Survey," HSBC OCC 3400666. [Sealed Exhibit.] See also emails indicating HBUS Compliance personnel 
were not compensated at levels consistent with its competitors, and risked losing qualified personnel. See, e.g., 
2/1/2007 email exchange among HBUS Carolyn Wind, HBUS Teresa Pesce and others, "MIP overages - 
URGENT," HSBC OCC 0616314-316, at 314 ("We are not at market with our current competitors" and "[t]hese 
officers and AML officers can get new jobs in a heartbeat"); 2/27/2007 email from HBUS Karen Grom to HBUS 
Carolyn Wind, Denise Reilly, Teresa Pesce, David Dew and others, "HUSI Compensation Review," HSBC OCC 
0616318 ("The banks who are approaching our employees have deep pockets and are willing to pay to get the talent. 
... In many cases, we are paying under the 'market data point' (50 th percentile)." and "The offers from head-hunters 
are in some cases double base salaries and double bonuses[.]"). 

107 9/6/2007 email from HBUS Alan Ketley to HBUS Alan Williamson, Judy Stoldt, and George Tsugranes, 
"Correspondent survey," HSBC OCC 0616384-385 (Mr. Ketley wrote "Our competitors all acknowledge filing 
more SARs than we do."); 9/6/2007 HBUS chart, "Correspondent Banking Survey," HSBC OCC 3400666. [Sealed 
Exhibit.] 

108 8/27/2007 email from HBUS Alan Ketley to HBUS Michael Gallagher, Charles DelBusto, Chris Davies, and 
Alan Williamson, "Addressing negative information," HSBC OCC 7688584-587, at 587. 
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On October 24, 2007, Ms. Wind met with the Audit Committee of the HNAH board of 
directors and, during the meeting, raised the staffing issue, particularly with respect to the 
Embassy Banking area which had been the subject of two recent OCC examinations uncovering 
severe AML deficiencies. Her supervisor, Regional Compliance Officer Janet Burak, also 
attended the Audit Committee meeting. The day after the meeting, in an email to HSBC Group 
Compliance head David Bagley, Ms. Burak expressed displeasure that Ms. Wind's comments 
had caused "inappropriate concern" at the Audit Committee: 

"I indicated to her [Ms. Wind] my strong concerns about her ability to do the job I need her 
to do, particularly in light of the comments made by her at yesterday's audit committee 
meeting .... I noted that her comments caused inappropriate concern with the committee 
around: our willingness to pay as necessary to staff critical compliance functions (specifically 
embassy banking AML support), and the position of the OCC with respect to the merger of 
AML and general Compliance." 109 

A month after the board meeting, after seven years as HBUS' Compliance head, Ms. Wind 
was fired. In a January 22, 2008 letter to the head of HBUS Human Resources, Ms. Wind wrote: 

"I was told on November 30, 2007 that I was being terminated effective 2/28/08, due to the 
fact that the Board had lost confidence in me. ... If the Board has lost confidence in me 
based on my comments at the October, 2007 Audit Committee, why have I been allowed to 
continue to run this critical department without additional supervision or any direct follow-up 
from Group Compliance?" 

Ms. Wind also wrote: "David [Dew] and I disagree on the extent to which my organization can 
withstand cost cuts and still maintain an effective compliance risk mitigation program. I also 
believe in an open dialog with the Board and its committees, which may go against the desires of 
some in the organization." 110 When asked about this document, Ms. Wind told the 
Subcommittee that she believed she was fired for telling the HNAH board about the need for 
additional Compliance resources. 111 

Hiring Freeze Continues. After her departure, the hiring freeze continued throughout 
2008. 112 In February 2008, prior to her leaving the bank, Ms. Wind discussed the staffing freeze 
with HNAH COO Anthony Gibbs: 



luy 10/25/2007 email from Janet Burak to David Bagley, OCC-PSI-00704789. 

110 January 22, 2008 letter from Carolyn Wind to Jeanne Ebersole, HSBC OCC 7730334. 

111 Subcommittee interview of Carolyn Wind (3/07/2012). Anne Liddy also reported that Ms. Wind told her in 2007 
that she had been terminated due to Ms. Wind raising resource concerns to the board's audit committee. 
Subcommittee interview of Anne Liddy (2/22/2010). Also see, Minutes of the Audit Committee Meeting, October 
24, 2007, OCC-PSI-0070680. 

112 On 1/17/08, Jeanne Ebersole, Executive Vice President HBUS Human Resources, wrote to the HBUS Executive 
Committee [EXCO], "Attached is a draft of the non-hiring freeze note to be sent to all GCBs 0, 1, 2 and the final 
headcount report for 2007 which we will discuss tomorrow at EXCO." 1/17/2008 email from HBUS Jeanne 
Ebersole to HBUS Chris Davies, David Dew, Janet Burak and others, "Draft Materials for EXCO," HSBC OCC 
0616259-260, at 259. 
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"HBUS Compliance has been required to manage down overall FTE [full time 
employees] while at the same time redeploying resources to priority needs. We also are 
in the midst of a 'hiring pause' which means that approval from appropriate EXCO 
members is required to fill any open position. I do not expect a lot of support for overall 
HBUS Compliance headcount increasing even if a portion of the time is allocated to other 
affiliates." 11 ^ 

In June 2008, a senior PCM operations manager emailed senior HBUS Compliance 
official Anne Liddy about growing backlogs in the OFAC Compliance program: 

"I have put forth the suggestion of hiring up some first level checkers for OFAC 
processing in the GSC. . .we're strapped and getting behind in investigations (on OFAC 
cases) and have some of our key managers in the queues releasing items. . .I'm told I 
cannot hire first level staff unless it's offshored. . ." 114 

An OCC examination later found that eight Compliance officers were under "rigorous pressure" 
to complete manual reviews of about 30,000 OFAC alerts per week. 115 

In July 2008, however, HSBC Group senior management determined that the hiring 
freeze would continue to the end of the year. CEO Michael Geoghegan wrote to HNAH CEO 
Brendan McDonagh and others: "We have agreed that we will have a headcount freeze until the 
end of the year." 116 

HBUS Compliance personnel, with the support of their business units, attempted to 
obtain an exception to the hiring freeze. In a September 2008 email, Michael Gallagher, PCM 
head at HBUS, requested additional Compliance staff, explaining: "I have expressed 
considerable concern for some time over the lack of resources both in compliance and within 
pcm [Payments and Cash Management] to adequately support kyc [Know Your Customer] and 
related regulatory requirements." 117 Lesley Midzain, then HBUS Chief Compliance Officer, 
echoed his concerns and requested four additional full time employees: 

"Given the hiring freeze in global businesses, I understand that it may also need approval 
by Paul Lawrence, but this has continued to be an area of notable risk and regulatory 
attention and which needs some stabilization for Compliance resources." 118 



113 2/12/2008 email from HBUS Carolyn Wind to HBUS Anthony Gibbs, Curt Cunningham, Denise Reilly and 
others, "Organizational Changes," HSBC OCC 0616264. 

114 See 6/19/2008 email exchanges among HBUS Anne Liddy and HBUS Nancy Hedges, "OFAC processing in 
GSC's," HSBC OCC 0616349-350, at 349. 

115 7/28/2008 OCC memorandum, "OFAC Examination - Payment and Cash Management (PCM)," OCC-PSI- 
01274962 ("the bank's Compliance teams are under rigorous pressure to process alerts and determin[e] a disposition 
in a timely manner"). [Sealed Exhibit.] 

116 7/23/2008 email from HSBC Michael Geoghegan to HNAH Brendan McDonagh and others, "2nd Half Costs," 
OCC-PSI-00727922. 

117 See 9/4/2008 email exchanges among HBUS Michael Gallagher and HBUS David Dew, Lesley Midzain, 
Andrew Long, Chris Davies and others, "Kyc hires," HSBC OCC 0616352-356, at 356. When asked about this 
document, Mr. Gallagher said that Mr. Dew had informed him that broader concerns in the U.S. and at Group 
necessitated a flat headcount. Subcommittee interview of Michael Gallagher (6/13/2012). 

118 Id. at HSBC OCC 0616354. 
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After expressing concern over how additional hires would impact operating expenses, Mr. Dew, 
HBUS COO, asked Ms. Midzain if "a couple of temps for two months" would "do the trick." 119 

Hiring did not improve during 2009. Wyndham Clark, who had been hired in 2009, as 
the new HBUS AML director, noted in an email that Janet Burak had recently approved three 
new compliance positions. He wrote: "Clearly a positive, although I understand that these were 
requested quite a while ago. I hope that isn't the typical response time." A senior PCM 
operations officer responded: "Oh, this was express time. Trust me on that. Usually the 
response is 'no.'" The Subcommittee was told that in September 2009, the HBUS 

121 

Compliance department had 130 full time employees handling AML compliance issues. 

OCC Examination. During late 2009 and the first half of 2010, the OCC expanded and 
intensified its examination of the bank's AML program as a whole. Mr. Clark made increasing 
use of temporary employees and contractors to answer OCC inquiries and address AML 
deficiencies. In August, he left the bank. By then, he was using nearly 100 temporary 
employees and contractors and had requested 50 additional permanent full time Compliance 
personnel. 122 Even with those additional resources, the OCC's September 2010 Supervisory 
Letter identifying AML deficiencies at the bank criticized HBUS' failure "to provide adequate 
staffing and resources to implement and maintain a BSA/AML compliance program 
commensurate with the bank's high risk profile." The OCC Supervisory Letter also noted: 
"Management is still in the process of determining an appropriate level of resources as they 
consider recommendations from outside consultants and make strategic decisions about the 

124 

business and risk on a prospective basis." 1 ^ By October 2010, the Compliance department had 

125 

increased to over 400 full time employees. 

AML Monitoring Deficiencies. In addition to AML leadership problems and inadequate 
AML staffing, another key component of HBUS' AML program involved its monitoring 
systems. During the period reviewed by the Subcommittee, dating from 2004, HBUS used a 
monitoring system called the Customer Activity Monitoring Program (CAMP). This system had 
many limitations and often required manual reviews by HBUS Compliance and AML staff. 

By 2006, as indicated earlier, HBUS Compliance was already struggling to handle the 
monitoring alerts generated by the bank's growing correspondent banking and cash management 
programs and described its personnel as "becoming overwhelmed." Backlogs of unreviewed 



Hy Id. at HSBC OCC 0616352. 

120 10/19/2009 email exchange between HBUS Wyndham Clark and HBUS Debra Bonosconi, "OF AC resources," 
OCC-PSI-00 162661. 

121 Subcommittee briefing by HSBC legal counsel (6/30/201 1). 

122 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering ('BSA/AML') 
Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335-365, at 29. 
[Sealed Exhibit.] 
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125 Subcommittee briefing by HSBC and HBUS executives (6/26/2012). 

126 See 10/31/2006 email from HBUS Alan Ketley to HBUS Michael Gallagher, Denise Reilly, and Charles 
DelBusto, "Additional Compliance headcount needed to support PCM," HSBC OCC 0616340-43, at 342. 
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alerts in different areas of the bank began to accumulate, including with respect to alerts 
generated by CAMP monitoring of client accounts and wire transfer activity; alerts triggered by 
the OFAC filter on transactions by potentially prohibited persons identified on OFAC lists of 
terrorists, drug traffickers, and other wrongdoers; and alerts related to potentially suspicious 
activity in Embassy Banking accounts. 

With respect to the general CAMP system alerts for PCM, HBUS Compliance set a goal 
that no more than 2% of AML alerts should remain in the system for over 120 days without 
being resolved. In addition, the system notified increasingly senior management if the backlog 
exceeded certain thresholds. For example, when the CAMP alerts hit 3%, bank compliance 
officials like Anne Liddy were alerted; when it hit 4%, higher level compliance personnel such 
as AML director Lesley Midzain were notified; if the backlog hit 6%, HNAH's Regional 
Compliance Officer Janet Burak was notified. In November 2009, the percentage of AML 
alerts in the system for longer than 120 days spiked from four percent in October to nine 

128 

percent. The backlog remained at nine or ten percent for the next four months, from 
December 2010 to February 2010, and then stayed around 6 or 7% from March to May 2010. 129 
In early 2010, as part of its expanded AML examination, the OCC discovered the CAMP 
backlog of more than 17,000 unreviewed alerts as well as a backlog of requests for enhanced due 

1 30 

diligence (EDD) reviews. On March 3, 2010, an OCC Supervisory Letter ordered the bank to 
eliminate the alert and EDD backlog by June 30, 2010. 131 The bank met the deadline using 
"offshore reviewers in India, HBUS staff in Delaware, HBUS temporary volunteers, [and] 
outside contractors." A subsequent review by the OCC, however, found "deficiencies in the 

133 

quality of the work," and required an independent assessment. The independent assessment 
found that 34% of the alerts supposedly resolved had to be re-done. 

As Ms. Wind reported to the board in October 2007, backlogs were also an issue in 
Embassy Banking. A 2008 OCC examination identified a backlog of over 3,000 alerts 
identifying potentially suspicious activity in Embassy accounts that had yet to be reviewed. 134 In 
response, HBUS initiated a concentrated effort to review and resolve those alerts prior to a 
folio wup OCC examination in July 2008. The folio wup examination found a backlog of about 



127 "Bankwide KRI AML Transaction Monitoring Alert Aging - K02854," HSBC OCC 7688689. 

128 Id. 
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130 3/3/2010 OCC Supervisory Letter HSBC-2010-03, "Backlog of Monitoring Alerts and Enhanced Due Diligence 
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[Sealed Exhibit.] 

133 Id. 

134 8/14/2008 OCC memorandum, "Government and Institutional Banking Update," OCC-PSI-00899227-233, at 
231. [Sealed Exhibit.] 

135 July 31, 2008 Memorandum from HBUS Debra Bonosconi to HBUS David Dew, Lesley Midzain, and Cam 
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120 days and 147 open in excess of 90 days (350 combined) and we are concentrating our efforts on reducing those 
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1,800 alerts, some of which dated from 2007. The OCC examiners recommended issuance of a 
cease and desist order to the bank in part due to the backlog, but the OCC instead issued a 
Supervisory Letter, identified the backlog as a Matter Requiring Attention by the bank, and 
required the backlog to be cleared by September 15, 2008. 136 The bank met that deadline. 137 

A third category of alert backlog involved transactions that were stopped by the OFAC 
filter as possible violations of OFAC regulations. Each transaction had to be manually reviewed 
and resolved by two 4-person OFAC Compliance teams in New York and Delaware. In July 
2007, HSBC introduced a new payment system, GPS, in the United States. The system had 
undergone several adjustments just prior to its launch, including changes to its OFAC filters, 

139 

which caused unexpectedly large backlogs. HBUS assigned a team to assist with clearing the 
backlog, but the problem still took weeks to resolve. 

In December 2009, HBUS' OFAC Compliance team in New York had accumulated a 
backlog of greater than 700 OFAC alerts. 140 The OFAC Compliance team requested five or six 
people from PCM for ten days to help clear the backlog. 141 PCM responded that it had no 
resources to loan, and suggested asking the Compliance team in Delaware for help. The OFAC 
Compliance team in New York indicated the Delaware Compliance staff was already "fully 
deployed" dealing with general alerts from the CAMP monitoring system: 

"We have considered all options at this point[;] the Compliance team in DE is already 
fully deployed dealing with wire camp alerts and bank examiner requests for the current 
exam. There is no bandwidth there at all[;] they are behind on the current alert clearing 

142 

process which we are also dealing with." 

Understaffed, HBUS Compliance and AML staff constantly battled alert backlogs while 
requesting additional resources. These requests, if answered, generally resulted in additional 
temporary staff dispatched only when backlogs grew to unmanageable levels. As the backlog 
increased, tensions grew, and in February 2010, Mr. Clark, the AML Director who had been on 
the job only a few months, wrote: "[W]e are in dire straights [sic] right now over backlogs, and 



136 See 9/4/2008 OCC Supervisory Letter HSBC-2008-07, "Government and Institutional Banking BSA/AML 
Examination," OCC-PSI-00 1 07607-61 1. [Sealed Exhibit.] 
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decisions being made by those that don't understand the risks or consequences of their 
decisions!!!!" 143 

The problems with HBUS' AML monitoring system were not limited to the backlogs. 
Additional issues involved an array of problematic decisions on what clients and countries 
should be designated high risk and subject to enhanced monitoring; what accounts and wire 
transfer activity should be subject to or excluded from routine AML monitoring; what 
parameters should be used to trigger alerts, including dollar thresholds, key words or phrases, 
and scenario rules that combine specified elements; and what "negative rules" should be used to 
decrease the number of alerts that would otherwise be generated for review. 144 The OCC's 
September 2010 Supervisory Letter identified multiple problems with each of these elements of 
HBUS' AML monitoring systems. 145 

Current Status of HBUS AML Program. In the two years since the OCC issued its 
September 2010 Supervisory Letter and both the OCC and Federal Reserve issued October 2010 
Cease and Desist Orders to HBUS and HNAH regarding the many AML deficiencies in their 
programs, both HBUS and HNAH, as well as HSBC, have made commitments to strengthen 
their AML programs, including by directing more resources to compliance needs. HBUS told 
the Subcommittee that Gary Peterson will remain as its Compliance head, and his deputy will 
take over the duties of AML director, to ensure both positions have a full time executive. 146 
HBUS also informed the Subcommittee that as of July 2012, it had increased its Compliance and 
AML staff to over 1,000 full time employees. 147 It is also in the process of replacing CAMP with 
an improved AML monitoring system, NORKOM. Additional reforms include scaling back its 
correspondent banking and embassy banking relationships by closing higher risk accounts, as 

148 

well as closing its banknotes business in 2010. With respect to HSBC affiliates, HBUS told 
the Subcommittee it has initiated due diligence reviews of all such affiliates to identify those that 
are high risk, enabled all affiliates to obtain internal audit findings and other information to 



14J 2/26/2010 email from HBUS Wyndham Clark to HBUS Debra Bonosconi, OCC-PSI-00165898. In another 
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0001-002, at 002. 
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do not meet either risk or return hurdles." 9/20/2010 email from Irene Dorner to Andrew Long and others, HSBC 
OCC 8876103-106. 
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improve affiliate risk assessments, ended any limits on the monitoring of affiliates, and increased 
affiliate information sharing to strengthen AML compliance. 149 

In addition, on April 30, 2012, HSBC Group issued a new Group Circular Letter 120014, 
announcing the intention of the bank to use the highest global compliance standards for every 
HSBC affiliate. The HSBC GCL stated: 

"We must adopt and enforce the adherence to a single standard globally that is 
determined by the highest standard we must apply anywhere. Often, this will mean 
adhering globally to U.S. regulatory standards, but to the extent another jurisdiction 
requires higher standards, then that jurisdiction's requirements must shape our global 
standard." 150 

This new GCL could represent a groundbreaking approach for the bank if it, in fact, pushes its 
affiliates toward uniform and high compliance standards. 

These reforms, like those announced in 2004 after the bank's last AML enforcement 
action, have the potential to resolve the AML deficiencies at the bank and push HBUS to an 
improved level of AML compliance. While HBUS has committed to making major changes, the 
bank made similar commitments under the 2003 enforcement action, which the OCC lifted in 
2006, after which the bank's AML program quickly deteriorated. On many occasions since then, 
HBUS responded to AML problems identified by the OCC by instituting new policies and 
procedures that appeared to be effective remedies. However, it has often been the case that 
regulators would subsequently cite HBUS for failing to comply with its own policies and 
procedures. In 2006, for example, when the OCC lifted the AML enforcement action, HBUS 
had already incurred over 30 AML-related Matters Requiring Attention, many of which cited 
AML problems similar to those that had formed the basis of the written agreement. 

In addition, not all of the AML reforms proposed since 2010 have proceeded smoothly. 
The new compliance head hired by the bank left after fifteen months. The bank's new 
monitoring system has been the subject of OCC criticisms aimed at whether its monitoring 
parameters have been correctly set to identify suspicious activity and provide adequate AML 
oversight of client account and wire transfer activity. 151 While the recent GCL could represent 
an important advance in requiring bank affiliates to adhere to the highest AML standards 
globally, as this report documents, it can take months, if not years, for HSBC affiliates to come 
into compliance with HSBC GCL directives. The burden of proof is on HSBC Group to show 
that its latest directive is taking hold and its affiliates are complying with the highest AML 
stands, and on HBUS to show that it is moving from an ineffective AML program to one that 
safeguards the U.S. financial system from abuse. 



149 Id. 

150 GCL 120014 - HSBC Global Standards 

151 See 5/25/2012 OCC Supervisory Letter HSBC-2012-19, "Payments and Cash Management (PCM); Bank 
Secrecy Act and Anti-Money Laundering (BSA/AML) System Examination," PSI-OCC-37-0004. [Sealed Exhibit.] 
See also 6/25/2012 HSBC response letter, "Supervisory Letter HSBC 2012-19 Payments and Cash Management 
(PCM); Bank Secrecy Act and Anti-Money Laundering (BSA/AML) System Examination," HSBC-PSI-PROD- 
0200315-341. 
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III. HBMX: PROVIDING U.S. ACCESS TO A HIGH RISK AFFILIATE 

HBUS has opened correspondent accounts for approximately 80 HSBC affiliates around 
the world, providing them with access to the U.S. financial system through clearing U.S. dollar 
wire transfers, cashing U.S. dollar checks, buying and selling physical U.S. dollars, and other 
services. 152 Some of those HSBC affiliates operate in high risk countries, provide services to 
high risk clients, or offer high risk financial products. Until recently, HSBC Group policy, 
however, allowed its affiliates to assume that any HSBC affiliate owned 50% or more by the 
Group met Group AML standards, were low risk, and required no due diligence prior to opening 
a correspondent account. 153 In conformance with that HSBC Group policy, for years, HBUS did 
not conduct any due diligence analysis or risk assessment of an HSBC affiliate prior to supplying 
it with a U.S. account. HBUS took that approach, even though U.S. statutory and regulatory 
requirements explicitly direct U.S. banks to conduct due diligence prior to opening a 
correspondent account for any foreign financial institution, with no exception for foreign 
affiliates. 154 

HBMX, an HSBC affiliate in Mexico, illustrates how providing a correspondent account 
and U.S. dollar services to a high risk affiliate increased AML risks for HBUS. HBMX was 
created when HSBC Group purchased a Mexican bank known as Bital in 2002. A pre-purchase 
review disclosed that the bank had no functioning compliance program, despite operating in a 
country confronting both drug trafficking and money laundering. For years, HSBC Group knew 
that HBMX continued to operate with multiple AML deficiencies while serving high risk clients 
and selling high risk products. HSBC Group also knew that HBMX had an extensive 
correspondent relationship with HBUS and that suspect funds moved through the HBMX 
account, but failed to inform HBUS of the extent of the AML problems at HBMX so that HBUS 
could treat HBMX as a high risk account. Instead, until 2009, HBUS treated HBMX as low risk. 

Contrary to its designation, HBMX engaged in many high risk activities. It opened 
accounts for high risk clients, including Mexican casas de cambios and U.S. money service 
businesses, such as Casa de Cambio Puebla and Sigue Corporation which later legal proceedings 
showed had laundered funds from illegal drug sales in the United States. HMBX also offered 



As of February 2010, HBUS had about 2,400 clients in its Payments and Cash Management (PCM) department. 
See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering ('BSA/AML') 
Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335-365, at 7. 
[Sealed Exhibit.] In June 2012, HBUS had a total of nearly 1,200 correspondent clients, of which 80 were HSBC 
affiliates. The HSBC affiliates had 395 HBUS accounts, of which 7 or 8 related to HBMX. Subcommittee briefing 
by HSBC legal counsel (6/20/2012). 

153 See, e.g., 4/9/2010 memorandum from OCC legal counsel to OCC Washington Supervision Review Committee, 
"Order of Investigation - HSBC Bank USA, N.A., New York, NY," OCC-PSI-00899482-485, at 2 (citing HBUS's 
12/1/2008 AML Procedures Manual at 12: "The only exception to the KYC Profile requirement is any client who is 
an HSBC Group affiliate in which HSBC has an ownership interest of 50% or more."). After the Setember 2010 
OCC Supervisory Letter criticizing its practice, HSBC Group changed its policy and now requires all affiliates to 
perform due diligence on all other affiliates. 

154 See, e.g., 4/9/2010 memorandum from OCC legal counsel to OCC Washington Supervision Review Committee, 
"Order of Investigation - HSBC Bank USA, N.A., New York, NY," OCC-PSI-00899482-485, at 2 ("The Bank is 
obligated to conduct due diligence, and, where necessary, EDD [Enhanced Due Diligence], on foreign 
correspondent accounts. 31 U.S.C. § 53 18(i)( 1). ... Section 5318(i) does not exempt foreign correspondent 
accounts that a bank maintains for its affiliates."). 
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high risk products, including providing U.S. dollar accounts in the Cayman Islands to nearly 
50,000 clients with $2.1 billion in assets, many of which supplied no KYC information and some 
of which misused their accounts on behalf of a drug cartel. HBMX was also the single largest 
exporter of U.S. dollars to HBUS, transferring over $3 billion in 2007 and $4 billion in 2008, 
amounts that far outstripped larger Mexican banks and other HSBC affiliates. Mexican and U.S. 
law enforcement and regulatory authorities expressed rconcern that HBMX's bulk cash 
shipments could reach that volume only if they included illegal drug proceeds that had been 
brought back to Mexico from the United States. In addition, for a three-year period from mid- 
2006 to mid-2009, HBUS failed to conduct any AML monitoring of its U.S. dollar transactions 
with HSBC affiliates, including HBMX, which meant that it made no effort to identify any 
suspicious activity, despite the inherent risks in large cash transactions. 155 

HBMX conducted these high risk activities using U.S. dollar correspondent and 
banknotes accounts supplied by HBUS. HBMX used those accounts to process U.S. dollar wire 
transfers, clear bulk U.S. dollar travelers cheques, and accept and make deposits of bulk cash, all 
of which exposed, not only itself, but also HBUS, to substantial money laundering risks. HBMX 
compounded the risks through widespread, weak AML controls, while HBUS magnified them by 
omitting the due diligence and account monitoring it applied to other accounts. HSBC Group 
also compounded the AML risks by failing to alert HBUS to HBMX's ongoing, severe AML 
deficiencies. 

A. HSBC Mexico 

In November 2002, HSBC Group purchased Mexico's fifth largest bank, Banco 
Internacional, S.A., then part of Grupo Financiero Bital, S.A. de C.V. (Bital), for about $1.1 
billion. 156 At the time of the purchase, Bital had roughly 6 million customers and 15,400 staff. 157 
This acquisition significantly increased HSBC's banking presence in Mexico. 158 HSBC later 
changed the name of the bank to HSBC Mexico S.A. Banco (HBMX) and the name of the 
holding company to Grupo Financiero HSBC, S.A. de C.V. (GF HSBC). GF HSBC is now one 
of Mexico's largest financial service conglomerates, owning not only HBMX but also a network 
of other financial firms. 159 HBMX currently has over 1,100 branches, $2 billion in assets, and 



155 See 9/13/2010 OCC Supervisory Letter HSBC 2010-22, OCC-PSI-00000230, at 2. [Sealed Exhibit.] 

156 See "HSBC Consuma la Adquision de GF BITAL," (1 1/25/02), 

http://www.hsbc. co m.mx/l/PA_l_l_S5/content/home_en/investor_relations/press_releases/infpress/hsbc_consuma. 
pdf; "HSBC Buys Mexican Bank Bital," CNN.com (8/25/2002), 
http://archives.cnn.com/2002/BUSINESS/asia/08/21/uk.hsbc. 

157 8/21/2002 "HSBC agrees to acquire Grupo Financiero Bital," HSBC press release, 
http://www.hsbc.eom/l/2/newsroom/news/2002/hsbc-agrees-to-acquire-grupo-financiero-bital. 

158 Two years earlier, in 2000, HSBC had acquired a smaller bank in Mexico, Republic National Bank of New York 
(Mexico) S.A. See 10/21/2011 "Doing Business in Mexico," HSBC publication, at 34, 
http://www.hsbc.eom/l/content/assets/business_banking/111021_doing_business_in_mexico.pdf. 

159 Among other entities, GF HSBC owns a securities firm, insurance company, and pension fund. See HSBC 
Mexico website, "Grupo HSBC Mexico," http://www.hsbc. com.mx/l/2/grupo. Former HBMX head Paul Thurston 
told the Subcommittee that HBMX experienced rapid growth from its purchase in 2002. Subcommittee interview of 
Paul Thurston (5/1/2012). 
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over 8 million clients. 160 HBMX and its Mexican parent are headquartered in Mexico City and 
together have over 19,000 employees. 161 HSBC typically refers to its Mexican operations as 
HSBC Mexico. 

Since the purchase of Bital, three persons have served as the head of HSBC Mexico. The 
first was Alexander (Sandy) Flockhart who served as Chairman and Chief Executive Officer 
(CEO) of HBMX, and later also as CEO of HSBC's Latin America operations, from 2002 to 
2007. After he was made Latin American regional head, Paul Thurston took the post of 
HSBC Mexico CEO and later also served as the HSBC Latin America CEO. 164 Mr. Thurston 
headed the Mexico operations for just over a year, from February 2007 to May 2008. When he 
was promoted and relocated to London, 165 Luis Pena Kegel became the new HSBC Mexico CEO 
and remains in that post today. 166 

Mexican banks, including HBMX, are regulated by the Comision Nacional Bancaria y de 
Valores (CNBV) which oversees Mexican banks and securities firms. The Mexican central 
bank, Banco de Mexico, the Mexican Ministry of Finance, the Mexican Treasury Department 
(SHCP), and the Mexican Financial Intelligence Unit (FIU) also perform oversight functions. 
Mexico has a well-developed set of AML laws and regulations. Mexican regulators and law 
enforcement agencies work with their U.S. counterparts to combat drug trafficking and money 
laundering in both countries. 

HBMX is a large, sophisticated bank offering a full range of banking services, including 
deposits, checking, foreign exchange, commercial banking services, private banking and wealth 
management, and correspondent banking. HMBX offers correspondent accounts to a wide range 
of financial institutions. HBMX also maintains correspondent accounts for itself at other banks 
around the world, including in the United States. In 2002, at the time Bital was purchased, the 
bank had $647 million in correspondent banking deposits in Mexico, $700 million in the 



See 10/21/201 1 "Doing Business in Mexico," HSBC publication, at 6, 
http://www.hsbc.eom/l/content/assets/business_banking/l 1 1021_doing_business_in_mexico.pdf; "Grupo HSBC 
Mexico," HSBC website, http://www.hsbc. com.mx/l/2/grupo. 

161 See HSBC website, Grupo HSBC Mexico, http://www.hsbc.com.mx/l/2/grupo, viewed 4/2/12. 

162 He was Group General Manager, Chairman and Chief Executive Officer of HBMX from 2002 to 2006, and 
Group Managing Director Latin America from 2006 to July 2007. See his biography on the HSBC website, 
http://www.hsbc. com/l/PA_esf-ca-app- 

content/content/assets/newsroom/media_kit/biogs/100223_sandy_flockhart.pdf. HSBC also has affiliates in 
Colombia, Panama, Peru, and Uruguay, among other Latin American locations. 

163 In July 2007, Mr. Flockhart was appointed CEO of The Hongkong and Shanghai Banking Corporation Limited. 
See his biography on the HSBC website, http://www.hsbc. com/l/P A_esf-ca-app- 
content/content/assets/newsroom/media_kit/biogs/100223_sandy_flockhart.pdf. 

164 In May 2008, Mr. Thurston was appointed head of GF HSBC, and later co-head of the Latin American Region. 
See his biography on the HSBC website, http://www.hsbc.eom/l/PA_esf-ca-app-content/content/ 
assets/newsroom/media_kit/biogs/1012 10_paul_thurston.pdf; "HSBC makes key international appointments," 
(4/15/2008), http://www.hsbc.eom/l/2/newsroom/news/2008/hsbc-makes-key-international-appointments. 

165 In May 2008, Mr. Thurston was appointed Managing Director of UK Banking, in charge of HSBC's retail and 
commercial banking operations in the United Kingdom. See "HSBC makes key international appointments," 
(4/15/2008), http://www.hsbc.eom/l/2/newsroom/news/2008/hsbc-makes-key-international-appointments. 

166 Mr. Pena was appointed head of GF HSBC. Id. Mr. Pena had previously headed Grupo Financiero Banorte and 
worked for 25 years at Banamax/Citigroup in Mexico. Id. Emilson Alonso was appointed Chief Executive of 
HSBC Latin America. Id. 
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Cayman Islands, and $143 million in New York. According to CEO Paul Thruston, HBMX 
experienced rapid growth in the early years after its acquisition. 168 HBMX also operates a branch 
in the Cayman Islands, HSBC Mexico S.A, which was established by Bital in 1980, with 
authority to offer customers U.S. dollar accounts. 169 At its peak in 2008, the Cayman branch, 
which has no offices or employees of its own and is run by HBMX personnel in Mexico, had 
nearly 50,000 client accounts and assets totaling $2. 1 billion. 170 

HBMX has had an extensive relationship with HBUS, obtaining U.S. dollar services 
through both correspondent and banknotes accounts. HBMX used its HBUS correspondent 
account primarily to process international wire transfers and clear U.S. dollar monetary 
instruments such as travelers cheques. It also made use of HBUS' Remote Deposit Capture 
service which enabled HBMX to send monetary instruments to HBUS electronically for 
processing. HBMX interacted at times with the HBUS Payment and Cash Management (PCM) 
division regarding this account. In addition, HBMX interacted with the HBUS Global 
Banknotes division, until the Global Banknotes business was discontinued in 2010. HBMX used 
its banknotes account primarily to sell U.S. dollars received from its customers to HBUS, which 
HBMX typically transported to HBUS via armed car or aircraft. In one three-month period from 
November 2006 to February 2007, HBMX shipped nearly $742 million in U.S. dollars to HBUS; 
at its peak, HBMX exported $4 billion in bulk cash shipments to HBUS over the course of one 
year, 2008. Until it sharply curtailed its U.S. dollar services in Mexico in January 2009, HBMX 
shipped more U.S. dollars to HBUS than any other Mexican bank or HSBC affiliate. 

B. Mexico 

To understand HBMX's AML risks and, therefore, the risks HBUS incurred as its U.S. 
correspondent, it is necessary also to understand the AML risks in its home country, Mexico. 
From 2000 until 2009, HSBC Group and HBUS gave Mexico their lowest AML risk rating, 
despite overwhelming information indicating that Mexico was a high risk jurisdiction for drug 
trafficking and money laundering. In May 2009, HBUS suddenly increased its risk rating for 
Mexico by three notches, from its lowest to its highest risk level, where it remains today. 
HSBC Group did not follow suit until 2012 when it raised its risk rating for Mexico from 
"cautionary" to "high risk." 172 



"""Compliance Due Diligence Trip by John Root: Bital (Mexico City) - 4-8 Nov02," prepared by HSBC John 
Root, HSBC OCC 8877802-807, at 5. 

168 Subcommittee interview of Paul Thurston (5/1/2012). 

169 This branch operates under a "Class B license," which is given by the Cayman Islands Monetary Authority to 
offshore banks authorized to do business only with non-residents of the Cayman Islands. See list of Cayman 
offshore banks at http://www.offshore-library.com/banking/cayman_islands/page_3; Subcommittee briefing by 
HSBC legal counsel on the Cayman accounts (4/20/2012). 

170 See chart at HSBC OCC 8876787, attached to 9/12/2008 email from HSBC John Root to HSBC Adrian Cristiani, 
"Cayman Accounts," HSBC OCC 8876784. 

171 See 4/9/2010 memorandum from OCC legal counsel to OCC Washington Supervision Review Committee, 
"Order of Investigation - HSBC Bank USA, N.A., New York, NY," OCC-PSI-00899482-485, at 484. 

172 Subcommittee briefing by HSBC legal counsel (7/5/2012). 
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(1) U.S. Assessment of AML Risk in Mexico 

INCSR Reports. In its annual International Narcotics Control Strategy Reports 
(INCSRs), which contain a country-by-country assessment of drug trafficking and money 
laundering risks, the U.S. State Department has consistently classified Mexico as a country of 
"primary" concern for money laundering, its highest risk rating. In 2002, the State 
Department described Mexico's drug trafficking and money laundering risks as follows: 

"Mexico faces a myriad of drug-related problems that include the production and 
transshipment of illicit drugs, money laundering, consumption and illicit firearms 
trafficking. ... The Government of Mexico's (GOM) longstanding commitment to 
combat drug trafficking and related crimes resulted in tangible successes against the 
Arellano Felix Organization (AFO), the Carrillo Fuentes Organization (CFO), and the 
Gulf Cartel - widely considered the top three drug groups in the country. . . . Mexico 
remains a major supplier of heroin, methamphetamine, and marijuana, and the transit 
point for more than one half of the cocaine sold in the U.S. . . . The industrial-scale drug 
trade has transformed narcotrafficking into one of Mexico' s deadliest businesses. . . . 
These organizations have demonstrated blatant disregard for human life as the executions 
of law enforcement personnel, government officials, and innocent bystanders have 
increased. ... In recent years international money launderers have turned increasingly to 
Mexico for initial placement of drug proceeds into the global financial system." 174 

The State Department also wrote: 

"The smuggling of bulk shipments of U.S. currency into Mexico and the movement of 
the cash back into the United States via couriers and armored vehicles, as well as through 
wire transfers, remain favored methods for laundering drug proceeds. Mexico's financial 
institutions engage in currency transactions involving international narcotics-trafficking 
proceeds that include significant amounts of U.S. currency or currency derived from 
illegal drug sales in the United States. Although drug trafficking continues to be the 
principal source of the laundered proceeds, other crimes including corruption, 
kidnapping, firearms trafficking, and immigrant trafficking are also major sources of 
illegal proceeds." 175 

Equally negative assessments of Mexico's drug trafficking and money laundering risks 
appeared in the State Department's annual INCSR reports over the next four years. In 2006, for 
example, the State Department wrote: 

"The illicit drug trade continues to be the principal source of funds laundered through the 
Mexican financial system. Mexico is a major drug producing and drug-transit country. 
Mexico also serves as one of the major conduits for proceeds from illegal drug sales 



See, e.g., "2000 International Narcotics Control Strategy Report," U.S. Department of State (hereinafter "2000 
INCSR"), at 621; 2002 INCSR at XII-60; 2006 INCSR Vol. II at 39; 2008 INCSR Vol. II at 62; 2012 INCSR Vol. II 
at 33. 

174 2002 INCSR at V-27-V-28. 

175 Id. at XH-161. 



40 



leaving the United States. Other crimes, including corruption, kidnapping, firearms 
trafficking, and immigrant trafficking are also major sources of illegal proceeds. The 
smuggling of bulk shipments of U.S. currency into Mexico and the movement of the cash 
back into the United States via couriers, armored vehicles, and wire transfers, remain 
favored methods for laundering drug proceeds. . . . 

According to U.S. law enforcement officials, Mexico remains one of the most 
challenging money laundering jurisdictions for the United States, especially with regard 
to the investigation of money laundering activities involving the cross-border smuggling 
of bulk currency from drug transactions. While Mexico has taken a number of steps to 
improve its anti-money laundering system, significant amounts of narcotics-related 
proceeds are still smuggled across the border. In addition, such proceeds can still be 
introduced into the financial system through Mexican banks or casas de cambio, or 
repatriated across the border without record of the true owner of the funds." 

The State Department's relentlessly negative assessments of Mexico's drug trafficking 
and money laundering vulnerabilities continued unabated. In 2008, the State Department wrote 
that "U.S. officials estimate that since 2003, as much as U.S. $22 billion may have been 

177 

repatriated to Mexico from the United States by drug trafficking organizations." Four years 
later, in 2012, the State Department wrote that drug cartels were using Mexican and U.S. 
financial institutions to launder as much as $39 billion each year: "According to U.S. authorities, 
drug trafficking organizations send between $19 and $39 billion annually to Mexico from the 
United States." 178 

Warnings. The State Department is far from the only governmental agency to have 
warned about the money laundering risks in Mexico. The U.S. Congress has held repeated 
hearings over the years highlighting money laundering and drug trafficking problems in 
Mexico. Witnesses have included the U.S. Justice Department, Homeland Security 
Department, Federal Bureau of Investigations, Drug Enforcement Administration (DEA), 
Financial Crimes Enforcement Network (FinCEN) of the U.S. Treasury Department, Internal 
Revenue Service (IRS), Customs and Border Patrol, and Coast Guard, among others. From 1996 
to 201 1, these hearings have painted the same grim picture drawn in the State Department's 
annual reports regarding the drug trafficking and money laundering threats in Mexico. 



176 2006 INCSR at 268-269. 

177 2008 INCSR at 327. 

178 2012 INCSR at 140. 

179 See, e.g., "Money Laundering Activity Associated with the Mexican Narco-Crime Syndicate," U.S. House 
Banking and Financial Subcommittee on General Oversight and Investigations, Serial No. 104-72 (9/5/1996); "Drug 
Control: Update on United States-Mexican Counternarcotics Efforts," Senate Caucus on International Narcotics 
Control, S.Hrg. 106-60 (2/24/1999); "Federal Strategies to End Border Violence," Senate Judiciary Committee, 
S.Hrg. 109-556 (3/1/2006); "Antidrug Package for Mexico and Central America: An Evaluation," Senate 
Committee on Foreign Relations, S.Hrg. 1 10-311 (1 1/15/2007); "Escalating Violence in Mexico and the Southwest 
Border as a Result of the Illicit Drug Trade," House Judiciary Subcommittee on Crime, Terrorism, and Homeland 
Security, Serial No. 1 1 1-25 (5/6/2009); "Exploring Drug Gangs' Ever Evolving Tactics to Penetrate the Border and 
the Federal Government's Ability to Stop Them," Senate Homeland Security and Governmental Affairs Ad Hoc 
Subcommittee on Disaster Recovery and Intergovernmental Affairs, S.Hrg. 1 12-384 (3/31/201 1). 
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In addition, warnings about money laundering problems in Mexico have been directed 
specifically to financial institutions operating in the United States. In 2005, multiple U.S. 
agencies worked together to produce a U.S. Money Laundering Threat Assessment which 
identified thirteen key money laundering methods and specifically identified Mexico as a high 
risk jurisdiction for several of them, including bulk cash smuggling, misuse of money orders, and 

1 80 

suspicious funds sent through money service businesses. In 2006, FinCEN issued an advisory 
to all U.S. financial institutions to "better guard against an increasingly prevalent money 
laundering threat involving the smuggling of bulk U.S. currency into Mexico," warning in 

1 Q 1 

particular against "the abuse of their financial services" by Mexican casas de cambio. The 
advisory explained that drug traffickers were smuggling bulk cash from the United States into 
Mexico, then depositing the funds with casas de cambios who were sending the cash back to the 

1 82 

United States via armored transport or by selling the U.S. dollars to U.S. banks. The advisory 
also warned about multiple wire transfers that "bear no apparent business relationship" with a 
particular casa de cambio, and U.S. deposits by casas de cambio of sequentially numbered 

1 S3 

monetary instruments. 

Wachovia Prosecution. Criminal prosecutions also alerted U.S. financial institutions to 
the money laundering problems in Mexico. In 2008, for example, news articles warned how 
Mexican drug cartels sent millions of dollars in illegal drug proceeds through a major U.S. 
financial institution, Wachovia Bank. 184 In 2010, the United States filed a deferred prosecution 
agreement detailing how Wachovia Bank had been used by Mexican foreign exchange 
businesses to launder at least $110 million in drug proceeds. 185 Filings in the case describe how, 
from 2003 to 2008, Wachovia Bank provided a variety of services for 22 Mexican casas de 
cambio (CDCs), despite evidence of suspicious activity. Those services included processing 
numerous U.S. dollar wire transfers for deposit into bank accounts around the world; 186 clearing 
large volumes of sequentially numbered U.S. travelers cheques; 187 and accepting numerous bulk 
cash shipments transported by armored car from the CDCs. 188 The filings report that, over a 
three-year period, the wire activity exceeded $374 billion and the bulk cash shipments exceeded 
$4.7 billion, far exceeding expected volumes. 189 Wachovia Bank also processed $20 billion in 



180 See Dec. 2005 "U.S. Money Laundering Threat Assessment," issued by the Money Laundering Threat 
Assessment Working Group, which included the U.S. Departments of Treasury, Justice, and Homeland Security, 
Federal Reserve, and Postal Service. 

181 "Guidance to Financial Institutions on the Repatriation of Currency Smuggled into Mexico from the United 
States," FinCEN Advisory No. FIN-2006-A003 (4/28/2006), at 1 . 
http://www.fincen.gov/statutes_regs/guidance/pdf/advis04282006.pdf. 

182 Id. at 1-2. 

183 Id. at 2. 

184 See, e.g., "Wachovia Is Under Scrutiny in Latin Drug-Money Probe," Wall Street Journal , Evan Perez, Gelnn 
Simpson (4/26/2008)(describing AML cases involving not only Wachovia Bank, but also American Express 
International Bank, which forfeited $55 million as part of a 2007 federal deferred prosecution agreement, and Union 
Bank of California, which forfeited $21.6 million as part of a 2007 federal deferred prosecution agreement, both of 
which were also charged with inadequate AML programs and suspected of being used by Mexican drug cartels to 
launder funds). 

185 See United States v. Wachovia Bank N.A. , Case No. 10-20165-CR-Lenard (USDC SDFL), Deferred Prosecution 
Agreement (3/16/2010) and Information (3/12/2010). 

186 See id., Factual Statement, Exhibit A to Deferred Prosecution Agreement (3/16/2010), at f][ 20, 24(1). 

187 Id. at 11[ 22, 24(2), 35. 

188 Id. at f 21, 24(3). 

189 Id. at 123. 
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sequentially numbered travelers cheques, the majority of which contained illegible names and 
unusual markings. 190 The deferred prosecution agreement and supporting factual statement 
charged Wachovia Bank with willfully failing to maintain an effective AML program, 191 
detailing numerous AML deficiencies including a failure to conduct due diligence on high risk 
clients; a failure to monitor wire transfers, pouch activities, and bulk cash shipments; and a 

192 

failure to report suspicious activity to law enforcement. To avoid prosecution, Wachovia 
Bank acknowledged responsibility for its conduct, paid $160 million in criminal and civil fines, 
and agreed to undertake significant AML reforms. 93 The Wachovia case received widespread 
media attention, providing further notice of the money laundering dangers in Mexico. 194 

(2) HSBC Assessment of Risk in Mexico 

Despite the overwhelming information available about substantial money laundering 
risks in Mexico, from 2002 until 2009, HBUS gave Mexico its lowest risk rating for AML 
purposes. 195 As a consequence, under HSBC Group policy, clients from Mexico were not 
subjected to enhanced monitoring by HBUS, unless they were also designated a Special 
Category Client (SCC), a relatively rare designation that indicates a client poses high AML risks. 
Had Mexico carried one of the two highest risk ratings, all Mexican clients at HBUS would have 
been subjected to enhanced due diligence and account monitoring. Instead, HBUS failed to 
conduct AML monitoring of most Mexican client account and wire transfer activity involving 
substantial funds. 

Risk Rating Process. Until recently, HSBC Group and HBUS issued AML country risk 
assessments using four categories of increasing risk, "standard," "medium," "cautionary," and 
"high." HSBC Group created a chart listing its country risk assessments, sent the chart to its 
affiliates characterizing its assessments as recommendations, and then allowed each HSBC 
affiliate to make its own assessment decisions. 196 At HBUS, the country risk assessments were 
compiled every six months by an AML compliance officer who gathered information from a 
number of sources, assigned numerical scores to each source, and then compiled aggregate 
scores for over 200 countries. 



191 See United States v. Wachovia Bank N.A. , Case No. 10-201 65 -CR-Lenard (USDC SDFL), Deferred Prosecution 
Agreement (3/16/2010), at ffl 3-4. 

192 See id., Factual Statement, Exhibit A to Deferred Prosecution Agreement (3/16/2010), at fj 28, 30-35. 

193 See id., Factual Statement, Exhibit A to Deferred Prosecution Agreement (3/16/2010), at fit 38-40; Deferred 
Prosecution Agreement (3/16/2010); "Wachovia Enters into Deferred Prosecution Agreement," U.S. Attorney's 
Office for the Southern District of Florida press release, (3/17/2010), http://www.justice.gov/usao/fls/ 
PressReleases/1003 17-02.html. 

194 See, e.g., "Wachovia is under Scrutiny in Latin Drug-Money Probe," Wall Street Journal , Evan Perez and Glen 
Simpson, April 26, 2008; "How a big U.S. bank laundered billions from Mexico's murderous drug gangs," The 
Observer , Ed Vulliamy, (4/2/2011), http://www.guardian.co.uk/world/2011/apr/03/us-bank-mexico-drug-gangs. 

195 See, e.g., Feb. 2009 "Rating 2009," prepared by HBUS, HSBC-PSI-PROD-0096390-397 (rating over 235 
countries and territories). 

196 Subcommittee interview of Ali Kazmy (2/29/2012). 

197 Subcommittee interview of Ali Kazmy (2/29/2012); Feb. 2009 "Rating 2009," prepared by HBUS, HSBC-PSI- 
PROD-0096390-397. 
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Those scores were then supposedly used to assign risk ratings. In fact, however, 
countries receiving similar scores often received different risk ratings. Those differences were 
attributable, in part, to an "HBUS discretion" factor which was listed as an official factor in the 
risk assessment process, included in the risk assessment chart, and used, according to the OCC, 
to alter the risk ratings for over 60 countries in 2009. 198 The OCC noted that HBUS offered "no 
discussion or documentation as to what constitute[d] permissible reasons to change the risk 
rating" using the HBUS discretion factor. 199 The OCC also found that HBUS did not apply its 
risk-rating methodology "in a consistent manner." The OCC wrote that, in 2009, of 73 countries 
that received a zero risk assessment score: 

"32 (44 percent) were rated standard, 32 (44 percent) were rated medium, 1(1 percent) 
was rated cautionary, and 8(11 percent) were rated Unclassified. The OCC found no 
documentation or support for the difference between the final ratings and the scores. 
While the bank elevated the risk ratings versus the scores, the bank has not adopted a 
repeatable, standardized procedure." 200 

The OCC criticized the HSBC country risk assessment process for not taking into 
account readily available country- specific information on money laundering and drug trafficking 

201 

risks, including in the annual State Department INCSR reports. Although INCSR information 
was often included in HBUS KYC client profiles, the INCSR country- specific risk ratings were 

909 

inexplicably excluded from the official HBUS country risk assessment scoring matrix. 

Still another OCC criticism was the HSBC Group's "unacceptable practice of assigning 
an overall risk rating to its non-SCC customers based solely on the risk rating that the bank has 

203 

given the country where the customer is located." One result of this practice, according to the 
OCC, was that HSBC had excluded from its routine AML monitoring "more than $60 trillion of 
wire transfers each year for customers domiciled in countries risk rated as 'standard' or 
'medium,' representing two-thirds of the total dollar volume" of wire transfers at HSBC. 204 
With respect to Mexico, the HSBC policy meant that, due to its low risk rating, all clients based 
in Mexico were considered low risk, unless rated an SCC, an outcome that the OCC viewed as a 
critical AML deficiency. One consequence was that high risk clients residing in low risk 
countries routinely escaped enhanced due diligence and account monitoring. 

2009 Change in Mexico Risk Rating. In February 2009, HBUS issued a chart with its 

90S 

latest country risk assessments. The chart provided risk scores and categories for 239 



19S See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering 
('BSA/AML') Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335- 
365, at 19. [Sealed Exhibit] 

199 Id. 

200 Id. 

201 Id. 

202 See Feb. 2009 "Rating 2009," prepared by HBUS, HSBC-PSI-PROD-0096390-397. 

203 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering ('BSA/AML') 
Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335-365, at 18. 
[Sealed Exhibit.] 

204 Id. at 2. 

205 See Feb. 2009 "Rating 2009," prepared by HBUS, HSBC-PSI-PROD-0096390-397. 



44 



countries. It assigned a score of "2" for Mexico, which was one of the lowest scores. When 
asked about this low score, the HBUS compliance officer then responsible for country risk 
assessments, Ali Kazmy, told the Subcommittee that, since 2006, HBUS' assessments had 
inadvertently failed to take into account a 2006 FinCEN advisory related to Mexico that would 

207 

have added 10 points to its score each year. As a result of its low score, Mexico was rated a 
"standard" risk, the lowest of the four risk ratings. 208 

This low risk rating was awarded despite a May 2008 email from Susan Wright, AML 
Compliance head for the HSBC Group, singling out AML concerns related to Mexico. 
Referencing "RMM - Country Risk," Ms. Wright wrote to HSBC Group Compliance head 
David Bagley and other colleagues: 

"I believe you have sight of our Country Reputational Risk Table but, as previously 
discussed, unless there are some specific concerns it is not proposed to highlight the 
highest risk countries as a matter of course. . . . 

Mexico - there are specific risks in relation to pressure from the US with regard to the 
laundering of the proceeds of drug trafficking through Mexican cas[a]s de cambios. 
HBMX have a number of customers who are cambios/money service businesses (MSBs) 
with links to the US and consequently payments from HBMX are made through HBUS. 
. . . [T]hese are notoriously difficult businesses to monitor .... [T]here is also US concern 
with regard to the amount of USD cash deposits and transactions between the US and 
Mexico and HBMX has been identified as one of the banks with the highest level of 
activity in this area." 209 

This email shows that the head of HSBC AML Compliance was aware of and communicated to 
other Compliance personnel the serious AML risks related to Mexico involving drug trafficking, 
suspect casas de cambio, and bulk cash smuggling, yet the February 2009 HBUS country risk 
assessments again assigned Mexico the lowest possible risk rating. 

Three months after issuing the country risk assessments in February 2009, however, on 
May 1, 2009, HBUS suddenly revised Mexico's risk rating, increasing it by three notches from 
the lowest to its highest risk rating. When asked by the Subcommittee about the timing, Mr. 
Kazmy explained that, "in early 2009," he had been asked by his supervisor, Anne Liddy, to take 
another look at Mexico's risk rating due to OCC concerns. 211 



Id. The risk scores ranged from to 28, and produced ratings of standard, medium, cautionary, and high. 

207 Subcommittee interview of Ali S. Kazmy (2/29/2012). See also Feb. 2009 "Rating 2009," prepared by HBUS, 
HSBC-PSI-PROD-0096390-397. Mr. Kazmy took over the country risk rating process from Lynda Cassell who left 
HBUS in mid-2006. The FinCEN Advisory was issued in April 2006, just before Ms. Cassell left. 

208 Mexico had received the same standard rating in 2008. See 2008 HBUS Country Risk Assessment for Mexico at 
HSBC-PSI-PROD-0096398-441 and 422. 

209 5/14/2008 email from HSBC Susan Wright to HBUS David Bagley, HSBC Karl Barclay. HBEU Derek 
Leatherdale, and others, "RMM - Country Risk," HSBC OCC 8873750. 

210 See 4/9/2010 memorandum from OCC legal counsel to OCC Washington Supervision Review Committee, 
"Order of Investigation - HSBC Bank USA, N.A., New York, NY," OCC-PSI-00899482-485, at 484. 

211 Subcommittee interview of Ali S. Kazmy (2/29/2012). 
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Ms. Liddy's request coincided with an intensifying law enforcement interest in Mexican 
casas de cambio suspected of laundering illegal drug proceeds through U.S. financial institutions, 
including HBUS. In February 2008 and again in November 2008, as detailed below, Mexican 
regulators confronted HBMX with suspicions that drug proceeds were moving through its 
accounts at HBUS. In January 2009, according to an internal HBUS email, a U.S. Homeland 
Security Department's Immigration and Customs Enforcement (ICE) agent met with HBUS 

212 

about a money laundering investigation involving one of their clients in Mexico. That same 
month, in response to Mexican AML regulatory concerns, HBMX stopped accepting U.S. dollar 
deposits at any of its Mexican branches. 

In June 2009, ICE also informed the OCC that ICE was investigating possible money 
laundering activity involving banknote accounts at HBUS. 213 ICE indicated that Mexican drug 
traffickers appeared to be using the black market peso exchange in New York to transfer funds 
through a particular Mexican financial institution, which then sent the funds through its U.S. 

214 

correspondent account at HBUS. Dan Stipano, OCC Deputy Chief Counsel, explained the 
scheme to the OCC Examiner-In-Charge at HBUS as follows: 

"The scheme ... is similar to activity that we have seen at Union Bank, Wachovia, and 
Zions. Basically, the way it works is that drug money is physically hauled across the 
border into Mexico, then brought back into the United States through wire transfers from 
casas de cambio or small Mexican banks, or else smuggled across the border in armored 
cars, etc., before being deposited in US. Institutions. According to AUSA [Assistant U.S. 
Attorney] Weitz, most U.S. banks, recognizing the risks involved, have gotten out of this 
business, but HSBC NY is one of the last holdouts (although, interestingly, he said that 

215 

HSBC-Mexico will no longer accept U.S. currency)." 

What U.S. law enforcement officials had found was that, because drug traffickers in the United 
States were having difficulty finding a U.S. financial institution that would accept large amounts 
of cash, due to strict U.S. AML controls, many were instead transporting large volumes of U.S. 
dollars to Mexico, and depositing the dollars at Mexican financial institutions. The drug 
traffickers could then keep their deposits in U.S. dollars through the Mexican financial 
institution's correspondent account at a U.S. bank, or exchange the dollars for pesos. The 
Mexican banks, casas de cambio, and other financial institutions that were the recipients of the 
cash typically shipped the physical dollars back to the United States for credit to their own U.S. 
dollar correspondent accounts at U.S. banks. HBUS' awareness of the increasing U.S. law 



See 1/19/2009 email from HBUS Denise Reilly to HBUS Lesley Midzain, "HBMX Banknotes Business - HSBC 
Mexico Press Release and Q&A," HSBC OCC 3633806-807. In a Subcommittee interview, HBUS AML 
Compliance officer Daniel Jack indicated that he attended the meeting, and the ICE agent expressed concern about 
possible money laundering through Consultoria, a former Mexican casa de cambio that had converted into a bank. 
Mr. Jack told the Subcommittee that HBUS closed the Consultoria account six months later. Subcommittee 
interview of Daniel Jack (3/13/2012). 

213 See 9/29/2009 email from Dan Stipano to Sally Belshaw, at 3, OCC-PSI-00928758; 6/28/2009 notes of telephone 
conversations, prepared by OCC Jim Vivennzio, OCC-PSI-00928759-761 (noting ICE agents had met with HBUS). 
[Sealed Exhibit.] 

214 See 6/28/2009 notes of telephone conversations, prepared by Jim Vivenzio, OCC-PSI-00928759. [Sealed 
Exhibit.] 

215 See 9/29/2009 email from Dan Stipano to Sally Belshaw, at 3,OCC-PSI-00928758. 
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enforcement and regulatory interest in Mexico may have contributed to its decision to review 
and, ultimately, in May 2009, to increase its risk rating for Mexico. 

One key consequence of the higher risk rating for Mexico was that, under Group AML 
policy, HBUS was required to conduct enhanced monitoring of all of its Mexican clients. 
HBUS' higher risk rating may have also put pressure on HSBC Group and other HSBC affiliates 
to boost their risk rating of Mexico as well. 

On June 18, 2009, Ms. Wright sent an email to Ms. Liddy asking her about the higher 
rating for Mexico. Ms. Wright wrote: 

"It has been drawn to my attention that in the latest US Country Risk Assessment Mexico 
has gone from a lower risk to high. I have received a number of queries from around the 
Group as to the reason for what they see as quite a dramatic change. 

Whilst I appreciate the risks involved in doing business with Mexico I would be grateful 
for some further and more detailed clarification as to why the change has been so 
dramatic. This will enable me to deal with a number of these queries." 

In response, Ms. Liddy asked Mr. Kazmy, the AML officer responsible for compiling the 
country risk ratings, to write up the reasoning for the higher risk rating. He wrote: 

"A number of sources are reviewed, a majority of which are government and 
international agencies, such as World Bank, IMF, FATF, CFATF, BIS, Central Banks, 
Transparency International, etc. in order to determine risk levels .... The U.S. 
Department of State issues detailed annual assessments] of each country via the 
International Narcotics Control Strategy Report highlighting, inter alia, money 
laundering, terrorist financing, corruption, and regulatory regime/oversight. An excerpt 
of such a report on Mexico ... is attached below. . . . 

As a result of events occurring in Mexico during the past several months with respect to 
drug trafficking and money laundering, as well as the general unrest these developments 
have caused, we have downgrade[d] Mexico to 'high' risk. The deteriorated situation is 
recognized by the Government of Mexico as evidence through the involvement of 
agencies tasked with the Anti-Money Laundering and Counter Financing of Terrorist 
(AML/CFT) efforts towards drafting an AML/CFT National Strategy . . . expect to be 



216 6/18/2009 email from HSBC Susan Wright to HBUS Anne Liddy, "Group CRRT and US Country Risk 
Assessments," OCC-PSI-00652829. See also 6/9/2009 email from HSBC David Bagley to HBMX Emilson Alonso, 
copies to HSBC Michael Geoghegan and others, "GMO Business reviews - LATAM," HSBC OCC 8874895 ("I 
fully acknowledge the level of priority and focus that you and the team have given to these issues and the progress 
that has been made particularly in Mexico and have taken all of this into account. . . . The basis for the rating is 
however: The inherent AML risk in Mexico is still very high and [t]here are not many other parts of the Group that 
have what is effectively a drugs war being conducted on the streets and also have the risk posed by potential sting 
and other operations by the US authorities. We have of course remediated our high risk accounts, but the historic 
weak account opening processes mean that we have overall lower levels of KYC across the customer base as a 
whole. . . . Happy to discuss further."). 
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issued sometime during 2009. . . . Our rating is in conformity with the view of the U.S. 
law enforcement." 217 

Ms. Liddy asked him how Mexico had been rated by the State Department in 2009, and 
whether that rating was worse than in the previous report, apparently not realizing that the State 

218 

Department had consistently given Mexico its highest risk rating for years. Mr. Kazmy told 
Ms. Liddy, incorrectly, that the State Department INCSR report did not rate countries for risk, 
but also provided numerous details from the 2009 INCSR report indicating that money 
laundering and drug trafficking risks had increased. 

In 2010, when the OCC sent HBUS a supervisory letter on AML deficiencies at the bank, 

220 

the letter included criticism of its country rating system. Under the heading, "Inadequate and 
Ineffective Procedures for Country Risk Ratings," the OCC listed "significant flaws" with the 
scoring and risk rating methodology, as well as with HBUS' decision not to monitor wire 
transfer activity for foreign financial institutions or other clients located in a standard or medium 
risk country, unless designated as an SCC client. The OCC wrote: 

"The bank's country risk ratings for its PCM [Payment and Cash Management division] 
wire monitoring are critical, due to the bank's unacceptable practice of assigning an 
overall risk rating to its non-SCC customers based solely on the risk rating that the bank 
has given the country where the customer is located. However, compounding this 
deficiency, the bank' s procedures for determining the critical country risk ratings are 
inadequate and ineffective. 

To determine the country risk rating, the bank employs a point system based on fifteen 
factors. HBUS' methodology appears straightforward ... [h]owever ... there are 
significant flaws in the implementation of the point system. . . . 

The bank's failure to risk rate countries appropriately has a significant impact on HBUS' 
BSA [Bank Secrecy Act] compliance, because customers' risk ratings affect a number of 
variable requirements relating to due diligence for foreign correspondents. For example, 
these variable requirements include the frequency with which the bank conducts site 
visits (every 12 months versus every 24 months) and the level of due diligence performed 
on beneficial owner and the senior management team." 221 



'"6/19/2009 email from HBUS Ali Kazmy to HBUS Anne Liddy, "Group CRRT and US Country Risk 
Assessments," OCC-PSI-00652829. 

218 6/22/2009 email from HBUS Anne Liddy to HBUS Ali Kazmy, "Group CRRT and US Country Risk 
Assessments," OCC-PSI-00652829. 

219 6/24/2009 email from HBUS Ali Kazmy to HBUS Anne Liddy, "Group CRRT and US Country Risk 
Assessments," OCC-PSI-00652829. 

220 See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/ Anti-Money Laundering 
('BSA/ AML') Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335- 
365, at 18-20. [Sealed Exhibit.] 

221 Id. at 18, 20. See also 4/9/2010 memorandum from OCC legal counsel to OCC Washington Supervision Review 
Committee, "Order of Investigation - HSBC Bank USA, N.A., New York, NY," OCC-PSI-00899482-485, at 3-4. 
The problems with HBUS' country risk assessments extended beyond Mexico to other countries as well. Some of 
the countries that should have been rated as having a high risk of money laundering, but were instead rated standard 
or medium, included Antigua, the Bahamas, Cayman Islands, and Switzerland. See Feb. 2009 "Rating 2009," 
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When asked why past risk assessments of Mexico had been so low, Mr. Kazmy told the 
Subcommittee that he was unable to explain the low ratings prior to 2009. 222 He indicated that 
he first saw the 2006 FinCEN advisory on Mexico in 2009. 223 He also indicated that, if he had 

224 

known what he later learned, he would have increased the risk rating earlier. 
C. HBMX's History of Weak AML Safeguards 

In addition to the substantial money laundering and drug trafficking risks plaguing 
Mexico for a decade, HBMX itself had a history of weak AML controls and a poor compliance 
culture, which the HSBC Group worked for years to improve, with limited success. While 
HSBC Group officials in London were well aware of HBMX's AML deficiencies and immersed 
in an effort to strengthen them, it did not inform its worldwide affiliates, including HBUS, of the 
problems. From 2002 until recently, HBUS remained largely ignorant of the extent of HBMX's 
AML and compliance deficiencies, despite providing HBMX with extensive correspondent 
services and giving it free access to the U.S. financial system. 

Non-Existent Compliance Function in 2002. In 2002, as part of its decisionmaking 
process to purchase Bital, HSBC Group reviewed Bital's compliance function, found it wholly 
inadequate, and determined that a major effort would be needed for the new bank to meet Group 
standards. In an email to his colleagues, David Bagley, head of HSBC Group Compliance, put it 
this way: 

"Sandy [Flockhart, HSBC Mexico head,] acknowledges the importance of a robust 
compliance and money laundering function, which at present is virtually non-existent. . . . 
There is no recognizable compliance or money laundering function in Bital at present .... 
Sandy thinks it is important to look both at issues affecting Mexico City, but also closer 
to the border where there appears to be substantial cross-border flows of monies, 
including USD [U.S. dollars] in cash." 225 

His comments followed a July 2002 audit performed by HSBC Group auditor prior to 
purchasing the Mexican bank providing a negative assessment of the bank's compliance 
program. The HSBC internal audit report detailed a wide range of specific problems as well as 
broader AML deficiencies: 

• "FRBNY [Federal Reserve Bank of New York] review in 12/2000 identified that 
82 of the 248 accounts reviewed lacked full documentation. 

• A review ... of documentation of accounts booked at the target's Cayman Islands 
branch . . . found that 41% of the accounts reviewed (92 of 224 reviewed) lacked 
full client information. 37 files had no client information. . . . 



prepared by HBUS, HSBC-PSI-PROD-0096390-397. As a consequence, clients from those jurisdictions were 
treated as low risk, and wire transfers involving those countries were not routinely monitored by HBUS. 

222 Subcommittee interview of Ali S. Kazmy (2/29/2012). 

223 Id. 

224 Id. 

225 7/10/2002 email from HSBC David Bagley to HSBC John Root, with copies to Sandy Flockhart and Richard 
Bennett, "Bital," HSBC OCC 8877797-798. 
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• The [monitoring] system does not have any capacity to aggregate transaction 
activity for any period other than a given day . . . [and] does not identify high risk 
clients as such. . . . 

• Private banking operations per se, are not identified. . . . 

• GFB [Grupo Financiero Bital] was involved in Operation Casa Blanca, a US 
government undercover sting operation undertaken to combat drug trafficking and 
money laundering activities in the US and Mexico. A former GFB account 
executive was found willing to establish fictitious accounts and moved illegal 
money through them. . . . GFB forfeited $3.1 [million] to the US government in 
1998. ... 

Conclusions 

The GFB Compliance effort is weak, and it appears that the target organization 
does not have a strong Compliance culture. 

• GFB does not, in reality, have a Compliance Department and one would 
have to be established and implemented .... 

• Reviews of account opening procedures and client documentation are 
sporadic, and the reviews normally do not encompass large populations of 
client files or activities. This effort needs to be strengthened. 

• Client transaction and activity monitoring is very limited. The reliance on 
account managers to identify and report unusual and suspicious 
transactions of their clients is a serious internal control shortcoming. . . . 
High risk clients receive no special monitoring coverage. . . . 

• Internal and external audit recommendations, and issues raised in 
regulatory reports do not receive proper respect and action. ... 

• Measures to promote and ensure staff discipline are not satisfactory. 
GFB's Code of Conduct lacks content, detail and spirit. ...Appropriate 
staff related policies would have to be implemented immediately as part of 
the overall effort to install a dedicated Compliance and internal control 

226 

culture throughout the organization." 

Despite Bital' s weak compliance function, HSBC Group completed the purchase on November 
22, 2002. 227 

Five Years of Effort. Over the next five years, from 2002 to 2007, HSBC Group 
initiated a number of efforts to strengthen Bital' s compliance and AML programs. While 
improvements were made, significant deficiencies persisted. 

In November 2002, immediately before purchasing Bital, John Root, a senior HSBC 
Group Compliance expert whom David Bagley asked to help work on AML issues at HBMX, 
visited the bank for a week and prepared a report cataloguing compliance issues and needed 



zzb July 2002 "Group Internal Audit: Due Diligence Review - Project High Noon," HSBC audit of Bital, HSBC 
OCC 8873846 -852. 

227 See 11/29/2002 minutes of HSBC Holdings pic Board of Directors, section 109.3, HSBC-PSI-PROD-0198570. 
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initiatives. Among other problems, his report noted the "lack of a 'control culture' at 

229 

Bital." The report also described a meeting with one of Bital's chief Mexican regulators who 
"was extremely critical" of the bank, repeating a number of times that controls "do not exist." 230 
The report noted that "some of his harshest criticism" were directed at the Bital Legal 

23 1 

Department "which he averred was 'not guilty of bad faith but extreme mediocrity.'" 
According to the report, the Mexican regulator recommended "sweeping changes in 
management." 232 

The report noted that Bital had 83 correspondent relationships with other financial 
institutions, including 20 well known and reputable banks and some institutions that required 
additional KYC information. Mr. Root recommended obtaining that added KYC information 
or closing some of those accounts by March 2003. The report also noted that Bital had accounts 
lodged at its own Cayman branch office, which operated as an offshore shell entity and was 
managed by Bital employees in Mexico City. The report recommended undertaking an analysis 
of all of the correspondent banking deposits, "particularly those in the Cayman Islands," by June 
2003. It also recommended an analysis of "all existing Private Banking, with particular attention 
to USD [U.S. dollar] accounts and fund transfers to New York and the Cayman Islands." In 
addition, it recommended developing a better electronic screening system for all account activity 
to identify suspicious transactions and a better process for investigating suspicious activity 
"without any tipping off." 235 

In 2002 and 2003, HSBC Group appointed a new Compliance head for HBMX, Ramon 
Garcia Gibson, formerly AML Director at Citibank's Mexican affiliate, Banamax; established an 
HBMX Compliance Department; hired additional staff; and installed a new monitoring system 
known as Customer Account Monitoring Program (CAMP) to detect suspicious activity. HBMX 
also hired a Money Laundering Deterrence (MLD) Director Carlos Rochin. Nevertheless, in 
2003, two inspection reports from Mexican authorities in January and August identified ongoing 
problems with the detection of suspicious transactions and the adequacy of the bank's Money 
Laundering Deterrence (MLD) handbook, which HSBC was then in the process of revamping. 



228 "Compliance Due Diligence Trip by John Root: Bital (Mexico City) - 4-8 Nov02," prepared by HSBC John 
Root, HSBC OCC 8877802-807. See also 1 1/25/2002 email from HSBC John Root to HSBC Richard Bennett and 
HSBC Matthew King transmitting the report, HSBC OCC 8877800 ("There is very little of what we would call a 
Compliance function. ... I did not encounter anybody at Bital who I thought immediately capable of building a 
Compliance department."). 

229 "Compliance Due Diligence Trip by John Root: Bital (Mexico City) - 4-8 Nov02," prepared by HSBC John 
Root, HSBC OCC 8877802-807, at 1. 

230 Id. 

231 Id. 

232 Id. at 2. 

233 Id. at 4. 

234 Id. at 6. Mr. Root told the Subcommittee that he became aware of the HBMX Cayman accounts at that time, but 
thought they were servicing Cayman residents. Subcommittee interview of John Root (4/26/2012). 

235 Id. at 4-5. 

236 See 1/22 and 26/2004 email exchanges among HBMX Ramon Garcia and HSBC John Root, Susan Wright, and 
David Bagley, "MLD Regulatory Report," HSBC OCC 8873393-394 
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In January 2004, HSBC Group's Board of Directors met in Mexico to allow Board 

237 

members to familiarize themselves with HBMX. During the meeting, the Board's Audit 
Committee reviewed HBMX's ongoing internal control issues. The Audit Committee's minutes 
stated that, "after being part of the Group for some 15 months," HBMX had made "very 
significant progress in raising the standards of its controls. It will, however, probably take 
another two years to fully reach Group standards. From experience with other acquisitions this is 
not unexpected." 238 

Five months later, in May 2004, HBMX's internal auditors filed a report containing a 
number of criticisms of the bank's compliance and AML efforts, indicating that much still 
needed to be done to cure its AML deficiencies. Finding HBMX's AML function to be 
operating "Below Standard," the internal audit report stated: 

"HBMX has insufficient controls to detect money laundering transactions in all areas of 
the Group in a timely manner. The implementation of the CAMP system is in process yet 
it only includes the Bank's transactions that have been registered in the Hogan system 
and fails to monitor those registered in other IT systems/HBMX subsidiaries. 

Direccion de Prevencion de Lavado de Dinero [Direction of Money Laundering 
Deterrence] has identified high-risk areas of money laundering transactions, which are 
not being monitored. 

The communication between LCOs [Local Compliance Officers] and Compliance does 
not enable the timely detection of the needs and weaknesses of the areas and subsidiaries. 

There are inadequate internal controls over the IT systems used to send information to the 
regulator on suspicious or relevant transactions to authorities. 

In our opinion, based upon the foregoing, the Direction of Money Laundering Deterrence 
is operating with a BELOW STANDARD level of Control Risk." 240 

Three months later, in August 2004, John Root, HSBC Group Compliance head for Latin 
America, again visited HBMX to examine the status of its compliance and AML efforts, 

241 

prepared a report, and sent it to senior officials at both HBMX and HSBC Compliance. The 
report indicated that, while substantial progress had been made over the past 18 months, AML 
deficiencies remained: 



lil 1/30/2004 minutes of HSBC Holdings pic Board of Directors, section 04/7, HSBC-PSI-PROD-0198571-572. 

238 Id. at 2. 

239 May 2004 "Informe General de Auditoria HBMX GAQ 040026 Compliance-Money Laundering," prepared by 
HSBC Group's internal audit ("Auditoria Interna Del Groupo"), HSBC OCC 8874376-381. 

240 Id. at 4 (emphasis in original). 

241 "HBMX Jul04 GHZ CMP Visit Report," prepared by HSBC John Root, HSBC OCC 8875567-575. See also 
8/10/2004 email from HSBC John Root to HSBC David Bagley, Richard Bennett, Matthew King, David Leighton, 
and Susan Wright, and HBMX Sandy Flockhart and Ramon Garcia, transmitting the report, HSBC OCC 8875565- 
575. 
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"Senior management has made significant progress in introducing Group Compliance 
Policy and Standards in HBMX. The head of the Compliance department, Ramon Garcia 
Gibson, has set the foundation for an effective Compliance function. 

HBMX controls are much improved from the situation that existed 12-18 months ago[.] 
However, Treasury back-office operations are a source of major regulatory concern, as is 
accurate and timely reporting to regulators. . . . 

[0]ne of the five commissioners of the CNBV . . . states, 'In the business area [of 
HBMX], the resources have arrived. In the area of controls, the resources have not 
arrived.' 

The CNBV gave us a 'fact sheet' in English with the following 'main concerns' .... 

Anti-money laundering processes - Although improvements have been seen, 
some concerns remain regarding deficiencies in process (no system for unusual 
operations detection and a poor identification of public figures and high risk 
customers) and over control of Panama's branch operations. . . . 

In a wide-ranging discussion, CNBV regulators commented that any outsourcing must be 
able to be audited from Mexico. They do not want outsourcing to jurisdictions with 
strong banking secrecy. . . . 

The Trusts department is struggling to improve the poor condition of its files. 
Notwithstanding a senior manager's optimism ['Most of them, KYC is okay' and 'Most 
deficiencies are not related to KYC], by far the greatest problem is missing KYC 
documentation. 

Of a total of 15,434 trusts, only 6,868 (41%) have completed documentation. 2,955 
(20%) of trusts have no documentation at all. ... 

Around USD 16 billion arrive from the United States each year, mostly through the 
branch network. Money laundering risk is mitigated by several factors: (1) remittances 
are generally small (US200-300), according to two senior managers; (2) due diligence 
appears to be adequate on the AML procedures of US third-party money services 
businesses; and (3) CAMP Retail, a software programme to detect suspicious 
transactions, is scheduled to be installed in the branch network in NOV04. 

Recommendation: HBMX CMP [Compliance] should sample periodically remittances 
from the United States to determine if, in fact, remittances are generally small and in the 
ordinary course of business." 242 

In September 2004, the CNBV conducted an inspection of HSBC's AML efforts and, 
contrary to the more positive tone described by HBMX internally, found them unsatisfactory. 



242 "HBMX Jul04 GHZ CMP Visit Report," prepared by HSBC John Root, HSBC OCC 8875567-575 (emphasis in 
original). 
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According to an internal HBMX compliance report, a CNBV report summarizing the 2004 
inspection criticized HBMX for: 

"not considering the risk exposure of the customer to determine the appropriate visitation 
process, not implementing procedures to update annually the files of high-risk customers 
and politically exposed persons, not defining internal criteria to determine customers' risk 
exposure and a delay in formalizing the Communication and Control Committee . . . 
responsible for sending SARs to the CNBV . . . and issuing money laundering deterrence 
policies." 243 

The Communication and Control Committee (CCC Committee, also called the Money 
Laundering Deterrence or MLD Committee), which was mandated by a 2004 Mexican law, was 
intended to act as the bank's primary internal unit to deter money laundering, so the delay in 
getting the committee underway was seen as a major AML deficiency. CNBV later fined 
HBMX more than $75,000 for the AML deficiencies identified in 2004, a fine which HBMX 
CIBM Compliance proposed contesting. 244 

In early 2005, an internal HBMX whistleblower hotline disclosed that HBMX 
compliance officials had fabricated records of mandatory monthly meetings by the CCC 
Committee, and provided the false records to a local CNBV regulator. 245 An HBMX 
investigation determined that the false records consisted of attendance sheets and minutes for 
CCC meetings that should have taken place from July to December 2004, but did not. They 
were fabricated by a junior employee at the direction of the HBMX Money Laundering 
Deterrence Director, Carlos Rochin, who then tendered his resignation and left the bank. 247 
Ramon Garcia, head of HBMX Compliance and the CCC Committee chair, received a written 
warning and was barred from receiving what would have been a substantial bonus for his work in 
2004. David Bagley, head of HSBC Group Compliance, wrote: 

"Overall RG [Ramon Garcia] has performed credibly, has worked very hard, and would 
otherwise be hard to replace. In the circumstances whilst we will need to keep his 
position under review at this stage I endorse the decision to retain his services given that 
his failure is limited to one of failing to supervise a very senior and trusted 
subordinate." 248 



"1Q07 Compliance Report to the CIBM Audit Committee," prepared by the HBMX Corporate, Investment 
Banking and Markets (Private) Audit Committee, HSBC OCC 8873286-287 (describing CNBV criticisms). 

244 Id. 

245 See 1/21/2005 email from HSBC David Bagley to HSBC Stephen Green and Richard Bennett, "Compliance 
Exception," HSBC OCC 8873671. 

246 See 2/16/2005 email from HSBC David Bagley to HSBC Stephen Green and Richard Bennett, "Disclosure Line 
- HBMX CMP," HSBC OCC 8873673; Feb. 2005 "HSBC Whistleblower Item 15 - HBMX: Investigation Report - 
Executive Summary," prepared by Head of Group Audit Mexico (GAQ)(hereinafter "Whistleblower Report"), 
HSBC OCC 8877877-885. 

247 Whistleblower Report at 5-6. 

248 2/16/2005 email from HSBC David Bagley to HSBC Stephen Green and Richard Bennett, "Disclosure Line - 
HBMX CMP," HSBC OCC 8873673. 
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Mr. Bagley's internal report found that the HBMX AML staff was riven by dissension 
and resentment and may have "exact[ed] retribution" against the MLD director for the dismissal 
of a colleague. His report concluded that Mr. Garcia would have to rebuild a "shattered Money 
Laundering Section." 49 It also noted that CNBV "reiterated . . . that, by comparison with other 
Mexican financial institutions, HBMX CMP [Compliance] appeared to be understaffed" and 
urged the bank to hire additional compliance personnel. 250 

In May 2005, John Root, HSBC Group Compliance head for Latin America, made 
another visit to HBMX for several days to evaluate its compliance and AML efforts. As before, 
he later prepared a report and provided it to colleagues at HSBC Group and HBMX. In a 
separate email transmitting the report six weeks later, Mr. Root noted that the HBMX MLD 
director who resigned in January 2005, had not been replaced despite the passage of six months, 
and a new director needed to be appointed "as soon as possible in order to reorganize promptly a 
demoralized department and improve AML controls." 251 The email noted the importance of "an 
independent, effective professional in the sensitive role of head of AML in Mexico." He also 
observed that "[p]rojects are started but seldom completed, perhaps because of the many 
ministerial tasks that have accrued since the departure" of the MLD director. Mr. Root wrote: 

"As you of course know, the work has piled up in the Compliance department, and 
Ramon needs help with the backlog. It is true that we have increased staff in the 
department, but they are mostly entry-level analysts in need of direction. It is important 
we hire an MLCO [Money Laundering Control Officer] as quickly as possible, and 
perhaps also a sort of 'operating officer' for Ramon to enable him to bring the department 
up to Group Standards." 252 

Mr. Bagley forwarded the Root email to a colleague and commented that "until we have the right 

o c o 

amount and mix of resources I cannot see [how] Ramon can make progress." Later that year, 
Leopoldo R. Barroso was appointed MLD director for HMBX. 

In November 2005, Richard Bennett, then HSBC Group General Manager of Legal and 
Compliance and the person to whom David Bagley, head of HSBC Group Compliance, reported, 
paid a brief visit to HMBX. 254 While there, he met with the bank's CNBV regulators who raised 
a variety of compliance issues. According to an email sent by Mr. Bagley, the concerns included 
the nature of the HBMX accounts in the Cayman Islands; the referral of clients to Mexico by 
other HSBC affiliates, especially in France; and access to HBMX AML information from other 
countries, in particular the United Kingdom. 



Whistleblower Report at 7. 

250 Id. at 8. 

251 7/6/2005 email from HSBC John Root to HSBC David Bagley, Susan Wright, and David Leighton, "Visit to 
HBMX - 18 - 25 May 2005," HSBC OCC 8876670-671. 

252 Id. 

253 7/6/2005 email from HSBC David Bagley to HSBC Richard Bennett, "Visit to HBMX - 18 - 25 May 2005," 
HSBC OCC 8876670. 

254 See 1 1/15/2005 email from HSBC David Bagley to HSBC John Root, "HBMX - Compliance Issues," HSBC 
OCC 8873264-266. 
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In December 2005, HBMX's internal audit group produced a 55-page report identifying a 
host of compliance and AML problems at the bank. 255 It found that HBMX Compliance had 
improved, but still rated it "Below Accepted Levels." Major deficiencies included a failure to 
make full use of the new CAMP monitoring system, a failure to ensure its monitoring parameters 
met local requirements, inefficient monitoring processes which made detection and analysis of 
alerts difficult, failure to apply CAMP to foreign remittances and HBMX subsidiaries, 
inadequate SCC risk profiles, failure to complete a MLD work plan, and inadequate training. 

The audit report was actually issued to HBMX in the spring of 2006, and its findings 

257 

were hotly contested by the HBMX MLD Director, Leopoldo Barroso. He communicated his 
views to HSBC Group Compliance and complained that the bank would be required to forward 
the audit report to the CNBV, which would not only create a "misleading" impression, but also 
would contradict a recent presentation HBMX had made on how its AML controls had 
improved. John Root, senior HSBC Group Compliance officer, forwarded HBMX AML's 
response to the audit findings to Susan Wright, head of AML and David Bagley, head of 
Compliance for HSBC Group. 259 Mr. Root commented: 

"[T]he audit points are being strongly rejected by HBMX AML. AML is also alleging 
errors of procedure .... Many, if not most, of the recommendations were 'rejected' or 
downgraded in importance by AML, which is certainly a heartfelt, but rather unusual 
formal reaction, to an audit. Most of just accept audit recommendations, whether 
perceived to be 'fair' or not, and proceed to implement them. 

I have let the dust settle a bit, as AML management clearly feel aggrieved, but closer 
monitoring is warranted on the specific audit recommendations. . . . 

[T]he one that most sticks out is apparent lack of monitoring of the (relatively few) AML 
staff in the field. This raises a 'red flag' in a place like Mexico, where the drag cartels 
are very powerful and ubiquitous. ... To aver, as the audit does, that 'we do not really 
know what our man in the field is doing' is a warning sign, if true. AML of course 
vigorously deny this." 

Mr. Barroso' s email responding to the internal audit noted that HBMX MLD had also recently 
been audited by CNBV and expected to receive a satisfactory rating, with only two requirements 
for improvements and several recommendations. 260 

HSBX's internal audit group continued to conduct compliance and AML examinations of 
HBMX offices and branches. In September 2006, for example, it examined operations at four 



See Dec. 2005 "Informe de Auditoria General: HBMX - Direccion de Compliance," prepared by Mexico Group 
Audit, HSBC OCC 8876223-280. 

256 Id., Executive Summary. 

257 See 5/17/2006 email from HSBC John Root to HSBC Susan Wright and David Bagley, "Internal Audit Reports," 
attaching 5/8/2006 email from Leopoldo Barroso and a chart entitled, "Internal Audit Main Findings to MLD," 
HSBC OCC 8874383-392. 

258 Id. at HSBC OCC 8874392 

259 Id. at HSBC OCC 8874383. 

260 Id. at HSBC OCC 8874384. 
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HBMX district offices, each with more than 15 branches, located in the cities of Puebla, 
Morelos, and Juarez. 261 All four district offices were found to be operating "Below Standard" 
with respect to their risk controls, which was the same low rating each had received the prior 
year. For example, all four were found to have KYC and "file integrity" issues that "failed to 
comply with Group policies." 262 One district office was found to lack knowledge of the 
procedures to identify Special Category Clients (SCCs). 263 All four district offices had five or 
six repeat recommendations from prior audits that had yet to be resolved. All four summary 
reports were circulated to HSBC Group Compliance senior officials. 264 

In October 2006, HBMX's Compliance head Ramon Garcia informed HSBC Group 
Compliance that HBMX's Money Laundering Deterrence (MLD) Committee had adopted a 
policy that would require HBMX to consider closure of an account after four Suspicious Activity 
Reports (SARs) had been filed with respect to an account's activity. In response, John Root, 
senior HSBC Group Compliance officer, responded: "4 SARs seems awfully indulgent, even by 
local standards. At any rate, it is against Group policy, as Susan [Wright] points out, so you will 
need to seek an official dispensation." 266 A "dispensation" was needed, because HSBC Group 
Policy No. GPP25 required accounts to be closed after two SARs were filed. The next day, 
HBMX informed HSBC Group Compliance that, rather than seek an official exception, it had 
decided to adopt the Group policy and would consider account closure after two SARS were 
filed, rather than four. 267 

Unimed and Ye Gon Scandal. In 2007, HBMX learned that one of its longstanding 
clients was accused of involvement with illegal drug trafficking. On March 15, 2007, in a joint 
effort with the U.S. Drug Enforcement Administration (DEA), the Mexican Government seized 



6 See September 2006 "Group Audit Mexico Audit Report Summary Schedule: GHQ Reportable Audits," for PFS 
Puebla Z01 C31 District Office (with 17 branches), PFS Puebla Z01 C23 District Office (17 branches), PFS Morelos 
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264 See 10/9/2006 email from HSBC David Bagley to HSBC John Root, forwarding message from HSBC Matthew 
King, "HBMX B/S and U Audit Report Summary for SEP06," HSBC OCC 8876715 (transmitting audit report 
summaries). See also August 2005 "General Audit Report: HBMX - PFS Torreon District (Z04 C01)," prepared by 
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265 See 10/17-18/2006 email exchanges among HBMX Ramon Garcia and Leopoldo Barroso and HSBC John Root, 
David Bagley, Susan Wright, and Emma Lawson, "2Q06 HBMX Compliance Report," and "Compliance with GPP 
25," HSBC OCC 8876711-713. 

266 10/17/2006 email from HSBC John Root to HBMX Ramon Garcia, with copies to HSBC David Bagley and 
Susan Wright, "2Q06 HBMX Compliance Report," HSBC OCC 8876713. 

267 See 10/17-18/2006 email exchanges among HBMX Ramon Garcia and Leopoldo Barroso and HSBC John Root, 
David Bagley, Susan Wright, and Emma Lawson, "Compliance with GPP 25," HSBC OCC 887671 1-713. GPP 25 
stated: "Where the customer is the subject of more than one validated suspicious transaction/activity report, then 
serious consideration should be given to closure of the relevant account/s and any other connected accounts." 
Despite adopting the Group policy generally to close an account after two SARs, HBMX apparently did a poor job 
of implementation. In November 2007, Mr. Garcia revealed at an HSBC conference that HBMX had "numerous 
cases of accounts with multiple SARs (16 in one case!!) in Mexico that remain open." In response, Ms. Wright 
asked Warren Learning to "follow up with Ramon" to strengthen compliance with the Group policy on closing 
accounts with SARs. 1 1/16/2007 email from HSBC Susan Wright to HSBC Warren Learning, copy to David 
Bagley, "Mexico," HSBC OCC 8875423. 
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over $205 million in U.S. dollars, $17 million in Mexican pesos, firearms, and international wire 

268 

transfer records from the residence of a wealthy Chinese-Mexican citizen, Zhenly Ye Gon. 
The cash, which had been hidden in a secret locked room in the residence, 269 was described as 

970 

the largest cash seizure in a drug-related case in history. 

Mr. Ye Gon, a prominent businessman, was the owner of three Mexican corporations 
involved in the pharmaceutical field, Unimed Pharm Chem Mexico S.A. de C.V.; Constructora e 

971 

Inmobiliaria Federal S.A. de C.V.; and Unimed Pharmaceutical, S.A. de C.V. He was accused 
of using his corporations to import, manufacture, and sell chemicals to drug cartels for use in 

272 

manufacturing methamphetamine, an illegal drug sold in the United States. He was also 
accused of displaying "significant unexplained wealth," despite reporting no gross income for his 
companies for the years 2005, 2006, and 2007. 273 In June 2007, Mr. Ye Gon was indicted in 

974 

Mexico on drug, firearm, and money laundering charges, but could not be located. In July 
2007, he was arrested in the United States, imprisoned, and indicted by U.S. federal prosecutors 

275 

for aiding and abetting the manufacture of methamphetamine. Two years later, in 2009, U.S. 
prosecutors dismissed the charges, after a witness recanted key testimony. 276 Mr. Ye Gon has 
remained imprisoned, however, subject to proceedings to extradite him to Mexico to stand 
trial. 277 Since his arrest, he has continually proclaimed his innocence. 278 

Mr. Ye Gon and his corporations were longtime clients of HBMX as well as other banks 
and casas de cambio in Mexico. One news article reported that the Mexican Ministry of Finance 
and Public Credit (SHCP) had determined that, from 2003 to 2006, Mr. Ye Gon and his 



268 See In re Zhenly Ye Gon , Case No. l:07-cr-00181-EGS (USDC DC), Complaint for Arrest with a View Towards 
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271 See Ye Gon Extradition Complaint at 6. 

272 See Ye Gon Extradition Complaint at 6-15; "Mexican Fugitive and Co-Conspirator Arrested on U.S. Drug, 
Money Laundering Charges," U.S. Drug Enforcement Administration press release (7/24/2007), 
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operations"). 
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companies moved $90 million through 450 transactions involving four major Mexican banks, 
HBMX, Banamex, BBV Bancomer, and Banco Mercantil Del Norte, and multiple currency 
exchanges, including Casa De Cambio Puebla and Consultoria Internacional Casa De Cambio. 279 
The March 2007 seizure of cash and weapons from Mr. Ye Gon's residence triggered an 

280 

intense review of his accounts by HBMX and HSBC Group. According to internal HBMX 
documents, the Unimed accounts were opened by Bital, retained by HBMX, and housed in 
HMBX's Personal Financial Services (PFS) division, even though the official clients were 
corporations and should not have been serviced by the PFS division. The accounts were not 
designated as high risk, despite unusual transactions that had attracted bank attention several 
times from 2003 to 2007. 282 John Root told the Subcommittee that during the 2003-2004 
timeframe, the Unimed account had attracted the attention of HBMX regulators, and Susan 

283 

Wright had instructed HBMX to terminate the relationship altogether. He said that the HSBC 
Group did not realize the account was still open, until he and Ms. Wright saw the press articles 
regarding Unimed in 2007. 

When the scandal broke, Paul Thurston, who had been appointed in February as HSBC 
Mexico CEO after the former head, Alexander Flockhart, was promoted, wrote: "This is a very 
serious, and high profile, case which has potential reputational damage to the HSBC Group, and 
must be given the highest priority." 284 

Mr. Thurston personally oversaw an extensive review of the accounts and HMBX's AML 
controls. When the head of HSBC Latin American internal audits, Graham Thomson, was 
asked to summarize the AML deficiencies that contributed to the bank' s maintaining such a high 
risk account, Mr. Thomson wrote in part: 

"The main systemic weaknesses in HBMX, which I believe remain outstanding, are as 
follows: 

KYC as identified in branch and continuous audit reports. 

The lack of adequate documentation and filing systems which remain from the former 
Bital days .... 



10/13/2007 "Reportan ruta de Ye Gon para 'blanquear' dinero" ("Ye Gon reported path to 'launder' money"), El 
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Lack of a compliance culture 

His criticisms about the lack of a compliance culture and poor KYC documentation echoed the 
criticisms made five years earlier, when HSBC first purchased Bital. 

HBMX's internal review determined that, in 2005 and several times thereafter, concerns 
about suspicious activity involving the Unimed account had been brought to the attention of the 
HBMX Money Laundering Deterrence Communication and Control Committee ("CCC 
Committee"). The CCC Committee apparently initially advocated closing the account, but 
then relented, in part because the Personal Financial Services (PFS) division where the account 
was located had, as one HBMX email put it, "argued that the client was fine, properly 
documented, and known by the business." 288 The key PFS official who vouched for the client 
apparently later claimed he'd been "lied to" by other bank personnel. 289 The review also 
uncovered falsified "KYC visit reports," documenting site visits to the client which had not 
actually taken place. 290 In addition, the review criticized poor analysis of the alerts which had 
spotted the "unusual" account activity. 291 One email noted that other Mexican banks with 
Unimed accounts "had not reported the customer to the authorities, despite hosting apparently 
unusual transactions similar in nature to those recorded by HBMX." 292 

As a result of the Unimed scandal, Mr. Thurston developed seven action items to 
strengthen HBMX's AML and KYC efforts. They included reviewing the personnel assigned 
to the HBMX CCC committee and reminding CCC members of the need to take "an independent 
view" and to be "prepared to challenge their colleagues"; ensuring CCC minutes clearly 
identified the decisions taken; revamping KYC "analysis, assessment and reporting procedures" 
to ensure "higher risk cases are brought to senior management attention"; providing additional 
training on KYC assessment reports; transferring all corporations out of the Personal Financial 
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Services division; and dismissing all branch staff involved with completing the falsified KYC 
reports. 294 Mr. Thurston also described the need to bring individual initiatives to improve KYC 
procedures, account opening and file maintenance into "one coherent programme" with 
"appropriate emphasis." 295 In addition, he described holding a special CCC Committee meeting 
within a week to review cases with similar patterns and other high risk cases. He also directed 
the internal audit group to conduct a review of HBMX's AML and CCC processes. 297 

The most senior levels of HSBC Group were kept informed about the case. On April 20, 
2007, for example, Matthew King, head of HSBC Group Audits, sent an email to HSBC Group 
CEO Michael Geoghegan with this update: 

"I am told the Mexican authorities are taking a relatively benign attitude to our 
involvement with this customer, which is fortunate because the review has revealed a 
number of weaknesses. A series of inaccurate, and possibly fabricated, visit reports seem 
to have been filed by the business which resisted any reporting of suspicions a number of 
times. For its part, the Moneylaundering Department failed to act as a proper check and 
balance. I have suggested a thorough review of processes within the Moneylaundering 
Department and of the Moneylaundering Committee to ensure they are robust. . . . There 
are also a number of personnel decisions to be taken." 

Neither HBMX nor HSBC Group informed HBUS about the case. 299 

The Unimed scandal broke nearly five years after HSBC first began working to 
strengthen HBMX's AML controls and create a compliance culture. It showed that, while 
progress had been made, HBMX still had multiple AML deficiencies and a poor compliance 
culture. 

2007 AML Efforts. For the rest of 2007, HSBC Group Compliance devoted attention 
and resources to strengthening AML controls at HBMX, with limited success. 

One step taken was to task the new HBMX Chief Operating Officer, John Rendall, with 
overseeing HBMX's KYC remediation effort for existing client files, an effort mandated by 
CNBV authorities but far behind schedule. 300 Mexican regulators had given Mexican banks until 



294 Id. at HSBC OCC 8875012. 

295 Id. 

296 Id. at HSBC OCC 8875012-13. HBMX did not identify any other corporate clients with a similar profile. 
Subcommittee interview of Paul Thurston (5/1/2012). 

297 This review produced an audit report in December 2007, discussed below. See Dec. 2007 "General & 
Transactional Banking Audit: HBMX - Money Laundering Deterrence," prepared by Group Audit Mexico, HSBC 
OCC 8874802-810. 

298 4/20/2007 email from HSBC Matthew King to HSBC Michael Geoghegan, and copy to David Bagley, 
"Managerial Letter: HBMX-[redacted by HSBC]," HSBC OCC 8874762. 

299 Subcommittee interview of Paul Thurston (5/1/2012). 

300 See, e.g., 2/27/2008 email from HBMX Paul Thurston to HSBC Michael Geoghegan and others, "CNBV/FIU 
Update," HSBC-PSI-PROD-0 198510-511. 
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2007, to update the KYC information in all customer files; HBMX had obtained an extension 

301 

until May 2008, but expected to be hard pressed to meet the new deadline. 

In June 2007, David Bagley, HSBC Group Compliance head, visited HBMX for several 
days, met with CNBV officials, and circulated a report on the outstanding compliance and AML 
issues. In an email transmitting his report, Mr. Bagley wrote: 

"[T]here do appear to be a number of issues to be resolved, particularly those relating to 
accurate ongoing account opening, prompt effective and complete remediation in 
accordance with CNBV requirements for existing accounts, and completion of the 
recommended enhancements to the working of the MLD committee. . . . [W]e will need 
on an ongoing basis to consider the nature and extent of the resources currently available 
in CMP [Compliance]. ... I suspect we are already stretched given the apparent growth 
that has already, or is intended to take place in this area which appears to be growth of 
both volume and complexity." 302 

303 

His five-page report detailed a number of compliance and AML problems. First was 
HBMX's anticipated failure to meet a Mexican regulatory deadline for reviewing the KYC 
information for all existing accounts to ensure compliance with regulatory requirements. The 
report noted: "There appeared to be differing opinions as to how many accounts were affected, 
how many accounts were outstanding and therefore no real tracking of the progress being made." 
The report recommended reaching a consensus on the method for tracking accounts and 
completing the task. The report also expressed concern about KYC weaknesses in opening new 
accounts. It noted: "If we are opening new accounts badly it will only add to the remediation 
exercise required by CNBV .... Accurate and complete account opening is a key AML control, 
particularly in emerging markets." A third key issue was "confusion as to the stated aims and 
purpose of the MLD Committee." A fourth was that "the CAMP monitoring system produces 
significant numbers of 'false' alerts. This is a feature of all AML monitoring systems. Having 
said this, steps are being taken across the Group to seek to minimize this," and recommended 
that similar steps be taken in Mexico. A fifth concern was that the compliance team was "lightly 
resourced." 

The report also discussed a "cordial" meeting held with CNBV regulators. It said that the 
regulators were "overall extremely positive about the bank" but also "had a fairly lengthy list of 
issues," most of which focused on compliance matters other than AML issues. 304 Paul Thurston, 
head of HSBC Mexico, thanked Mr. Bagley for the "constructive report." He wrote: 



3U1 See 7/27/2007 minutes of LAM Regional Audit Committee, HSBC OCC 8875086-088, at 3 ("CNBV has granted 
a 1-year extension to MAY08 for HBMX to regularize customer identification files for accounts] opened or 
contracts signed before MAY04."); 12/2007 audit of "HBMX-Money Laundering Deterrence (MLD)," No. HBMX 
GAQ 070086, prepared by HSBC Group Audit, Executive Summary, HSBC OCC 8876347 ("HBMI has been given 
an extension by the Regulator from May 07 to May 08 to ensure that a portion of the client files (known as the UBA 
project - about 1.8m customers) are completed."). 

302 6/27/2007 email from HSBC David Bagley to HBMX Paul Thurston and others, "Visit Report," HSBC OCC 
8874967-968. Mr. Bagley visited Mexico and Panama from June 1 1 to June 14, 2007. See 7/27/2007 Minutes of 
LAM Regional Audit Committee, HSBC OCC 8875086-090, at 3. 

303 June 2007 "Summary of Compliance Issues - Mexico," report prepared by David Bagley, HSBC OCC 8874970- 
974. 
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"I agree with your comment that we need to review the role and resources in the 
Compliance function. ... For all Ramon's strengths, I have equally seen weaknesses in 
addressing key issues . . . and in my view the jury is out on his ability to do all that we 
need in HBMX, let alone try to oversee other countries in the region. . . . [W]e should 
review between the three of us in a few month's time, when we see what progress is 
being made." 305 

The very next month, July 2007, John Root, head of Latin American Compliance, sent a 
blistering email to Ramon Garcia condemning HBMX's CCC Committee for "rubber-stamping 
unacceptable risks": 

"A number of items jump out from your most recently weekly report (02JUL-06JUL) but 
everything pales in comparison with the ML items on page 4. It looks like the business is 
still retaining unacceptable risks and the AML committee is going along after some initial 
hemming and hawing. I am quite concerned that the committee is not functioning 
properly. Alarmed, even. I am close to picking up the phone to your CEO. 

[Redacted by HSBC] looks like another [Unimed 306 ] type of situation - what on earth is 
an 'assumption responsibility letter' and how would it protect the bank if the client is a 
money launderer? Please note that you can dress up the USD 10 million to be paid ... to 
the US authorities as an 'economic penalty' if you wish but a fine is a fine is a fine, and a 
hefty one at that. What is this, the School of Low Expectations Banking? ("We didn't go 
to jail! We merely signed a settlement with the Feds for $ 10 million!") . . . 

So, [Unimed 307 ] is strike one. [Redacted by HSBC] is strike two. Let's now look at strike 
three. (I hope you like baseball.) 

The same person who is giving the sancrosanct 'assumption responsibility letter' for 
[Redacted by HSBC] ... is being asked by the CEO to explain why he retained the [Casa 
De Cambio Puebla ] relationship after USC1 1 million was seized by the authority in 
[Puebla 309 ] account with Wachovia in Miami. What?! The business was okay with this? 

The AML Committee just can't keep rubber-stamping unacceptable risks merely because 
someone on the business side writes a nice letter. It needs to take a firmer stand. It needs 
some cojones. We have seen this movie before, and it ends badly." 310 



3U3 6/29/2007 email from HBMX Paul Thurston to HSBC David Bagley and John Rendall, "Visit Report," HSBC 
OCC 8874965. 

306 Although the client name was redacted from the document by HSBC, John Root confirmed that Mr. Thurston was 
referring to Unimed. Subcommittee interview of John Root (4/26/2012). 

307 Id. 

308 Although the client name was redacted from the document by HSBC, the reference to a seizure of $1 1 million 
from Wachovia Bank in Miami indicates that the client is Casa de Cambio Puebla. See discussion below. 

309 Id. 

310 7/17/2007 email from HSBC John Root to HBMX Ramon Garcia, with copies to Susan Wright, David Bagley, 
and Warren Learning, "Weekly Compliance Report 02JUL-06JUL07," HSBC OCC 8875925-927. 
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Mr. Garcia responded that he was escalating the two cases involving high risk clients as 

311 

part of a revised AML procedure in the CCC Committee. He explained that Mexican law 
essentially required the CCC committee to give great weight to the opinion of the business side 
of the bank, because "they are the ones that really know the customer." He said that he had 
escalated the cases to the HBMX CEO, because MLD had "a different opinion" from the 
business "about reporting the case to authorities." Essentially, he said that the final decision 
belonged to the HBMX CEO, rather than the CCC Committee. 

The next week, Paul Thurston, HSBC Mexico CEO, supported the CCC Committee's 
recommendation to close one of the accounts, but not the other. He supported closing the 
account of Casa de Cambio Puebla, which had been a client for more than 20 years, but whose 
funds at Wachovia Bank had been seized by the U.S. Justice Department and Drug Enforcement 
Administration (DEA). 312 Mr. Thurston cautioned John Rendall, the HBMX Chief Operating 

313 

Officer, to alert CNBV and to ensure CNBV had "no objection." Mr. Rendall also suggested 
alerting their US counterparts since HBUS had the same relationship with the client. 314 The 
second account involved a U.S. money services business, Sigue Corporation, which specialized 
in remitting funds from the United States to Mexico and Latin America. Mr. Thurston, on the 
advice of Mr. Rendall and the commercial banking division, kept that account open. 315 

Later in July, the HSBC Latin American (LAM) Regional Audit Committee held a 

•5 1 A 

meeting in Mexico. Participants included HSBC Group Compliance officials Brian 
Robertson, David Bagley, and Matthew King; LAM/HBMX officials Paul Thurston, Emilson 
Alonso, and Graham Thomson; HBMX Compliance head Ramon Garcia; and others from HSBC 
affiliates throughout Latin America. Mr. Thomson, head of LAM Internal Audit, discussed risk 
and compliance issues in several countries, and noted that Regional CEOs were now required to 
"take disciplinary action should a manager record 2 consecutive Below Standard control risk 

317 

assessments or record significant repeat recommendations." With respect to Mexico, Mr. 
Thomson noted that although 96% of HBMX electronic records reportedly met regulatory 
requirements, there was a "high level of exceptions and variance between the paper and 
electronic records" which would require "a large rectification effort" to meet the regulatory 
deadline of May 2008. He also noted that branch offices were not sufficiently familiar with 
SCC requirements, and criticized the CCC Committee for failing to folio wup on instructions to 
close client accounts. Mr. Thurston noted that the CCC Committee was introducing an 



311 7/18/2007 email from Ramon Garcia to HBC David Bagley, "Weekly Compliance Report 02JUL-06JUL07," 
HSBC OCC 8875925. 

312 See July 2007 email exchanges among HBMX Paul Thurston, John Rendall, Ramon Garcia, and others, "[subject 
redacted by HSBC] , HSBC OCC 8875 1 32- 1 35 . 

313 Id. at HSBC OCC 8875132. 

314 Id. 

315 See 2/4/2008 email from HBMX John Rendall to HBMX Paul Thurston, "[redacted by HSBC]," HSBC OCC 
8875139. Six months later, in January 2008, Sigue Corporation entered into a deferred prosecution agreement with 
the U.S. Justice Department, admitting that some of its agents had been laundering drug proceeds. See United States 
v. Sigue Corp. and Sigue LLC , Case No. 4:08CR54 (USDC EDMO), Deferred Prosecution Agreement Factual 
Statement (1/28/2008). HBMX's relationship with Sigue Corporation is discussed further below. 

316 See 7/27/2007 Minutes of LAM Regional Audit Committee, HSBC OCC 8875086-090. 
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escalation process to senior management to resolve disputes over closing accounts. Ramon 
Garcia also reported that automation problems were causing delays in the issuance of Suspicious 
Activity Reports (SARs), but that interim manual reviews had not detected activity requiring any 
SARs to be filed. 320 He also described a new pilot project at 94 HBMX branches to centralize 
management and control of account documentation using electronically imaged documents. 

CNBV Escalates Concerns. Two months later, in October 2007, the CNBV asked to 
meet with Paul Thurston, the HSBC Mexico CEO, to express ongoing concerns about HBMX's 
compliance and AML efforts. Mr. Thurston summarized the meeting in an email to the HSBC 
Group CEO Michael Geoghegan. 321 He wrote: 

"At their request, I met today with the Head of Banking Supervision, and the Supervisor 
for HSBC, from our regulator, the CNBV, following their on site examination of various 
aspects of our business, including cards, money laundering, and treasury operations. . . . 

They walked me through a presentation pack which firstly set out specific points . . . but 
then moved on to more general concerns of the CNBV with HSBC in Mexico. These 
centered on: 

- weaknesses in internal controls . . . slow progress in tackling KYC data problems and 
anti money laundering procedures. 

- corporate culture, where they comment that . . . HSBC has driven growth in credit 
products and launched new products without adequate controls. ... 

They also expressed concerns at senior management having dual responsibilities for 
Mexico and the region, stating that 'there are many concerns on how management will be 
able to implement strong controls within the bank in Mexico, while keeping an eye on 
other countries.' ... 

I indicated to them we were aware of these issues and were progressively tackling 
them." 322 

His email then outlined the steps he told CNBV that HBMX was taking, including new 
hires, "customer file centralizing and imaging which would give us more robust KYC data for 
anti-money laundering," and working to change the culture of the bank which "would not happen 
over night." 323 Mr. Thurston wrote that the CNBV officials told him that was "what they wanted 
to hear and that they would report back positively" to the head of the CNBV. Mr. Geoghegan 



319 Id. Mr. Thurston explained that if compliance and business personnel disagreed over closing an account, the 
dispute would be escalated to the HBMX COO, and then to the CEO. In addition if a business wanted to close an 
account, a higher ranking Executive Director would have to make the decision. Subcommittee interview of Paul 
Thurston (5/1/2012). 

320 Id. at 3. 

321 10/23/2007 email exchange between HBMX Paul Thurston and HSBC Michael Geoghegan, "CNBV Inspection," 
HSBC OCC 8873338-342. 
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responded: "This is disturbing and clearly we will need to look at the management structure and 
practices. ... I am copying this to the Group Chairman and Matthew King for their 
information." 

In December 2007, the internal audit group for Mexico issued a report that had been 
ordered earlier on HBMXs AML efforts. 325 It found HBMX's AML controls to be "Below 
Standard" and to pose an overall "high" risk. 326 It detailed multiple problems, including 
"[r]egulatory breaches in KYC issues such as the large number of incomplete client files and the 
inadequate process of SCC identification and monitoring across the network." It noted that 
HBMX had a May 2008 deadline for bringing files into compliance with KYC regulations set by 
the CNBV, and that regulators had been told 86% of client files already met regulatory 
requirements, while audit work over the past year suggested a much lower percentage, "as low as 
46%." The audit report also noted that the KYC effort was remediating only 1.8 million files 
involving high risk, excluding another almost 6 million clients "that the Group has in Mexico 
which are subject to HSBC's own MLD policies." 328 

The 2007 audit report also disclosed SAR filing and alert review backlogs. It noted 
"4,890 accounts that reported unusual transactions that took place between APR [April] and 
AUG07," but which had yet to be reported to Mexican authorities, "thereby breaching the 
regulations." 329 It attributed the delay to changed internal criteria for reporting transactions, 
resulting in an increase in the number of cases to be reported, and "slow decision-making." 
The report also noted 7,217 alert warnings of which 858 (12%) had not been reviewed at all, 
"posing a potential risk that criminal transactions may not be identified which may have an 

33 1 

adverse reputational effect on the Institution." The audit report stated that the failure to 
review these alerts had been going on for one year due to "insufficient Operations staffing." The 
report also criticized "Senior Management" for attending few AML committee meetings, 
delaying decisions on cancelling accounts, and delaying the imposition of sanctions when cases 
were not reported to the CNBV on time. 332 The report also noted a lack of "sufficient 
understanding" of the AML IT systems and inadequate AML training as evidenced by the 
"failures regularly identified in branch audits." 333 In light of the "number and in many cases 
seriousness of the weaknesses identified," the report recommended creating an HBMX Money 
Laundering Committee to undertake the effort needed to address the widespread AML 
shortcomings. 
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Confronted by this long list of AML deficiencies, HSBC Group sent Warren Learning, 
HSBC Group Compliance Deputy Head, to Mexico to help determine what should be done. 3 4 

CNBV and FIU Dissatisfaction Deepens. As 2007 drew to a close, HSBC Group and 
HBMX worked to strengthen HBMX's AML efforts, but CNBV dissatisfaction with the bank 
seemed to deepen and the list of AML concerns broaden in 2008, encompassing for the first time 
concerns about HBMX's participation in bulk cash services. 

In February 2008, Mr. Thurston, HSBC Mexico CEO, met again with CNBV officials, at 

335 

their request, along with the Mexican Financial Intelligence Unit (FIU). According to an 
email he sent summarizing the meeting, CNBV handed him a draft report detailing multiple 
compliance concerns. 336 Mr. Thurston wrote: 

"It is clear in this that our Head of Compliance is not as highly regarded by the CNBV as 
had been thought by local and Group management, and indeed appears to have misled us 
about the extent to which the CNBV have been informed of, and/or are satisfied with, our 
actions." 337 

HSBC Group CEO Geoghegan responded: "This is most disturbing and we will need to have the 
most thorough of investigations." 3 8 

The report provided by the CNBV stated that "[a]s a result of the increase in bank's 
operations, there has been an increase in deficiencies in internal control." It described a 
variety of problems. With respect to AML issues, the report concluded that "little improvement" 
in AML controls had occurred since the prior year's on-site inspection. 340 It noted that, of 1 10 
client files reviewed, "55 files (50%) were incomplete," and 5 files were not provided at all. It 
noted a "[l]ack of closer supervision to high profile risk clients"; a lack of risk criteria to classify 
clients during the account opening process; and missing client updates for high risk customers 
and politically exposed persons. 341 Another deficiency was that the CAMP and HOGAN 
monitoring systems did not collect transaction profiles for new accounts, as required by law, and 



334 See, e.g., 12/6/2007 email from HSBC John Root to HSBC Warren Learning and others, "Warren Learning 
HBMX DEC Visit Issues," HSBC OCC 8875837 ("I am keeping a list of issues that you might want to raise during 
your December visit to HBMX," including deteriorating audits of treasury operations, resourcing concerns, "Sinaloa 
massive money-laundering scheme (+USD 100 million)," "HBMX Trusts backlog," "Banistmo business in 
regulatory and tax havens," and "AML systems integration"). 

335 See 2/18/2008 email from HBMX Paul Thurston to HSBC Michael Geoghegan, with copies to Richard Bennett 
and Matthew King, "Confidential - CMBV/FIU Meeting," HSBC OCC 8873331-333. 

336 Id. at HSBC OCC 8873333. 

337 2/18/2008 draft report entitled, "Internal Control, HBC Mexico, S.A.," prepared by CNBV, HSBC OCC 
8966021-026, at 6. [Sealed Exhibit.] 

338 2/18/2008 email from HSBC Michael Geoghegan to HBMX Paul Thurston and others, including HSBC Group 
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8966021-026, at 1. [Sealed Exhibit.] 
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the CCC Committee delayed closing suspicious accounts, citing the example of a $2.8 million 
account kept open for an entire year after it was supposed to be closed. 342 

The report also described a number of AML deficiencies identified by the FIU, stating: 
"Evidence obtained by the Financial Intelligence Unit of Mexico (UIF) on a frequent basis has 

343 

seriously raised its concern on the very high level of ML risk that HSBC may be incurring." ~ It 
provided a chart showing that HSBC had much more bulk cash transactions using U.S. dollars 
than other Mexican banks, and expressed U.S. and Mexican law enforcement concern that the 
cash represented illegal drug sale proceeds from the United States. 344 The FIU also noted that 
HBMX frequently failed to provide requested information, claiming the files or basic account 
documents could not be located, providing a chart showing HBMX's response record was worse 
than other Mexican banks. 345 The FIU also noted that "in the majority of the most relevant ML 
cases" it had investigated in 2007, "many transactions were carried out through HSBC," and in 
some cases, the FIU detected ML transactions that HSBC had not reported. 346 The FIU also 
noted that it had been able to obtain copies of account documents that HBMX had claimed it 
could not locate. "These last cases may imply criminal responsibility of HSBC and its personnel 
- such as that relating to false statements to administrative authorities and complicity - that the 
law enforcement and judicial authorities must investigate." 347 

Internal HBMX and HSBC Group documents indicate that senior management 
immediately began to investigate the allegations. HSBC Group CEO Michael Geoghegan spoke 
to HSBC Group Chairman Stephen Green, as well as senior HSBC Group and HBMX personnel, 

348 

and asked David Bagley to lead the review of HBMX Compliance/" Mr. Bagley left for 
Mexico immediately for a two-week stay. Mr. Thurston directed the head of Latin American 
Security to investigate certain allegations, and the head of Latin American internal audit to 
examine the other CNBV and FIU complaints. 349 Mr. Thurston promised an updated report to 
Mr. Geoghegan prior to an upcoming HSBC Group Board meeting. 

Three days later, on February 22, 2008, Matthew King composed a draft email as a way 
to organize the information that should be conveyed to Mr. Geoghegan in a telephone call, and 
circulated his self-described "brain dump" to Mssrs. Thurston, Bagley, Bennett, and Graham 

350 

Thomson for their thoughts. The email indicated that the AML concerns raised by the CNBV 
were "pretty similar" to issues raised earlier, but the CNBV had "suddenly become more 
aggressive." The email speculated on whether that was due to political pressure, FIU concerns, 
or possibly a separate disagreement with the FIU regarding reimbursing a public utility for a 
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fraud. Mr. King also wrote: "It is also the case that Mexico is suffering a major problem with 
drugs dealers and the Government is being very robust about dealing with them." 

The King email then went through the issues. It noted that the December 2007 internal 
AML audit of HBMX was "Below Standard," and that the AML Director Leopolodo Barroso 
would be replaced, "albeit the FIU apparently regard him as trustworthy" so his replacement 
would have to be "carefully explained." 351 The email said that the "biggest immediate concern" 
was account KYC, which had been "a systematic problem for some time." Among other matters, 
the email noted that a pilot project to centralize account documentation through electronic 
imaging was underway, but "Audit is continuing to identify a high level of exceptions for that 
process also (around 30%). " 352 Mr. King wrote: 

"Given the concerns now raised by the CNBV and FIU (which apparently includes tapes 
of a drug lord recommending HBMX as the place to bank) we now have to decide: 
whether the imaging process can be made to work to everyone' [s] satisfaction^] how 
quickly it can be rolled ou[t] across the whole network[; and] in the meantime, whether 
we can continue to open accounts using the old, flawed process." 

The email also described account documentation as "a problem since we bought Bital," and 
noted that CNBV had again questioned having HBMX personnel handle compliance issues for 
the Latin American region in addition to Mexico. 354 On "cross-border cash," the email indicated 
that trends still needed to be clarified, but he thought the United States had "a general concern 
rather than a specific one about us." 

The next day, February 23, 2008, Paul Thurston sent an email to Michael Geoghegan 
with additional information. He wrote: 

"Firstly, to answer your question of why is this being raised now? The intelligence that 
we have been able to gather is that with President Felipe Calderon declaring war on the 
drugs gangs, crime and corruption the judicial authorities have heightened the focus on 
financial investigations and have been putting increasing pressure on the bank regulators 
because the banks have been seen as not providing good enough support. . . . HSBC has 
historically, and continues to have, a worse record than the other banks, so we have 
become a focus of attention. The new Head of the FIU has told us that his staff have told 
him that HSBC has been the most difficult bank to obtain accurate and timely data from 
for the past 4 years." 355 



351 Id. at 1. 
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Mr. Thurston wrote that HBMX had taken more corrective action than the regulators 
were aware of. 356 He acknowledged an account documentation problem which would be 
addressed, in part, by a new centralized electronic imaging procedure which was taking effect 
Mexico-wide that month. In addition, he wrote that "stronger disciplinary procedures" were 
being put in place for branch managers who signed off on account openings without personally 

OCT 

ensuring all documents were obtained. He also noted that HBMX received more than 1,000 
letters per week from the CNBV asking for account information, and that more resources had to 
be dedicated to responding to them. 

Finally, on the bulk cash issue, Mr. Thurston wrote that the United States had a general 
concern, "not aimed specifically at HSBC," about the flow of U.S. banknotes from Mexico and 
the potential linkage to drug related activity." 358 He wrote that HBMX had undertaken its own 
analysis of the cash flows, and initial indications were that its handling of U.S. dollars "had been 
slowly declining in recent years, rather than rising." 359 

On February 27, 2008, Mr. Bagley conducted an exit interview with the HBMX AML 
Director Leopoldo R. Barroso, who was being replaced. Mr. Barroso provided a negative view 
of HBMX AML performance. According to a meeting summary written by Mr. Bagley, Mr. 
Barroso said that, while in his position, he had felt civil and criminal "litigation exposure" due to 
"the continued poor controls in the bank, the fact that there were allegations of 60% to 70% of 
laundered proceeds in Mexico went through HBMX and because he did not think that senior 
management had any commitment to robust AML controls." Mr. Barroso indicated that "it 
was only a matter of time before the bank faced criminal sanctions and cited a number of cases." 
Mr. Bagley wrote: 

"It was clear that LRB [Leopoldo R. Barroso] felt very strongly that relevant business 
heads within HBMX had absolutely no respect for AML controls and the risks to which 
the Group was exposed and had no intention of applying sensible or appropriate 
approaches. Again he cited a number of examples where despite strong 
recommendations with the CMP [Compliance] business heads had failed or refused to 
close accounts or indeed on occasions file SARs. He thought that there was a culture that 
pursuing profit and targets at all costs and in fact had seen no recent improvement in the 
standard of controls or the types of decisions being taken. 

He was critical of the level of resources in his team and felt that his team had done much 
to keep the bank out of trouble by working extra hours against impossible deadlines and 
handling significant volumes of alerts including those from CAMP. . . . 

[H]e thought he needed at least 35 new headcount. . . . 



357 Id. at 1-2. 

358 Id. at 2. 

359 See also 2/27/2008 email exchange between HBMX Paul Thurston and HSBC Michael Geoghegan, "CNBV/FIU 
Update," HSBC-PSI-PROD-0 198510-512. 

360 2/27/2008 "Meeting Attendance Note," prepared by David Bagley, HSBC OCC 8874824-825. 
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He was extremely critical of RG [Ramon Garcia] who he described as being indecisive, 
weak and desperate to retain his job and lacking any understanding of AML matters." 

Mr. Bagley later forwarded his summary of the meeting to Mr. Thurston who responded 
that "the jury is still out on Ramon" and a discussion was needed on structuring the Latin 
American regional and Mexican compliance responsibilities. 362 

On March 3, 2008, HBMX issued a 12-page response to the internal control issues raised 
by the CNBV in its draft report of February 27. The response detailed multiple "corrective 
actions" being taken by the bank to address each concern. Among the actions discussed were the 
new centralized process for ensuring account opening documentation was obtained and 
electronically recorded; a new effort to centralize PEP files, obtain missing documentation, and 
strengthen annual PEP reviews; new disciplinary procedures for opening accounts with 
incomplete documentation; the re-engineering and strengthening of the alert reporting process; 
replacement of the AML director; and strengthening of the AML staff. The response also 
indicated that management changes had been made to split responsibilities for Mexico from the 
rest of the Latin American region. On the issue of U.S. banknotes, the response indicated that 
HBMX U.S. dollar volumes had not increased, but were marginally lower than in 2003. It also 
announced a new policy, effective immediately, to deem all customers who deposit more than 
$100,000 in a month as SCC clients subject to enhanced due diligence. The response said that 
312 customers met that criteria and were being subjected to a KYC review. 

Mr. Thurston and Mr. Bagley met with CNBV and FIU officials on March 4, 2008, to 
deliver the response and discuss the bank's actions. They reported to Mr. Geoghegan that the 
meeting was "extremely cordial" and the bank's corrective efforts were "well received." 364 After 
Mr. Bagley returned to London, he also discussed the matter with the Financial Services 
Authority (FSA), HSBC's UK regulator, which had communicated with CNBV. Mr. Bagley 
reported that "CNBV confirmed that they were satisfied with the reaction and steps we have 
taken although will watch implementation closely." 365 In April 2008, at a meeting of the HSBC 
Group Board of Directors, Mr. Bagley briefed the HSBC Group Audit Committee about HBMX, 
indicating that regulators had "expressed their satisfaction with the Group's reaction." 

Restoration Project. HBMX spent the next six months working to carry out the 
corrective actions outlined in its March response to CNBV. HBMX also underwent personnel 
changes. In May 2008, Paul Thurston was promoted and returned to London, having spent a 
little more than one year in Mexico. Luis Pena Kegel took over as HSBC Mexico CEO and head 
of HBMX. Emilson Alonso was appointed head of HSBC Latin America, carrying out the 
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362 3/7/2008 email exchange among HSBC David Bagley and HBMX Paul Thurston and John Rendall, "HBMX," 
HSBC OCC 8874821-822. 
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364 3/5/2008 email from HSBC David Bagley to HSBC Michael Geoghegan and others, "CNBV/FIU Meeting," 
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365 3/15/2008 email from HSBC David Bagley to HBMX Paul Thurston and others, "CNBV," HSBC OCC 8875171. 

366 4/25/2008 Board of Directors minutes for HSBC Holdings pic, HSBC-PSI-PROD-0198539-540. 



71 



commitment made to CNBV to split the two sets of responsibilities. In the summer of 2008, a 
new HBMX AML director was also hired, Jaime Saenz. 367 

One key AML activity undertaken by the bank was to work on bringing the KYC 
documentation for existing accounts into compliance with CNBV requirements, an effort HBMX 
deemed "Projecto Restauracion" or the Restoration Project. HBMX was supposed to have 
completed the KYC effort by May 2008, after having obtained a one-year extension, but was far 
behind schedule. HBMX appointed John Rendall, HBMX COO, to oversee the new project. 
One step he took was to limit the project to high risk accounts. He also assembled a team and 
began pressing branch personnel to complete their KYC updates. John Root, HSBC Group 
Compliance head for Latin America, attended a meeting of the Restoration Project team during a 
visit to Mexico in July, and was "very impressed" by the progress to date. 369 

Also in July 2008, Mr. Rendall provided a progress report to the Latin American regional 
audit committee on a number of AML and compliance efforts, outlining "9 workstreams." He 
described several milestones, including implementing the centralized account opening process 
for all HBMX branches, initiating the KYC Restoration Project "focused on high risk accounts," 
achieving a "90% reduction (from 34,700 to 3,300)" in the 2008 CAMP alert backlog, requiring 
enhanced KYC for customers with over $100,000 in U.S. dollar deposits, and improving FIU 
response procedures. 370 

On a more negative note in July, HBMX's internal monitoring system generated a 
number of alerts identifying "significant USD [U.S. dollar] remittances being made by a number 
of customers to a US company alleged to have been involved in the supply of aircraft to drugs 

37 1 372 

cartels." The alerts highlighted account activity in the HBMX Cayman branch. As a 
"precaution" pending review of the account activity, HBMX stopped opening new Cayman 
accounts. 373 The account activity also prompted HSBC Group to take a closer look at the 

'in A 

Cayman accounts. HSBC Group Compliance head David Bagley wrote that the Cayman 
accounts should be included in the Restoration Project "as a priority area," and should "be seen 
as high-risk from an AML and reputational perspective." 375 

In September 2008, HBMX's internal audit group reviewed the Restoration Project and 
quickly identified multiple, growing problems. In an email describing the audit findings, 
Graham Thomson, head of the Latin American internal audit group, wrote: 



367 See 7/30/2008 email from HSBC John Root to HSBC David Bagley and others, "HBMX Visit Update," HSBC 
OCC 8873487-489. 

368 See 6/7/2010 email from HBUS Paul Lawrence to HSBC Michael Geoghegan, "Mexico Banknotes/High-level 
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370 See 6/7/2010 email from HBUS Paul Lawrence to HSBC Michael Geoghegan, "Mexico Banknotes/High-level 
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371 7/31/2008 email from HSBC David Bagley to HSBC Richard Bennett with copies to HSBC Michael Geoghegan 
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"The key issues . . . include slow progress with remediating PEPs/SCCs and other high 
risk customers, with some 40% of the KYC records of PEPs/SCC customer segment . . . 
not yet remediated. These accounts are now in the process of closure by HBMX Legal. 
. . . [C]hecks done by CMP [Compliance] on visit reports . . . continue to reveal an 

'inf. 

unacceptable level of 'manufactured' visit reports." 

Mr. Alonso, head of HSBC Latin America responded that the audit results were "disappointing" 
and "not what I was assured by HMBX management." 377 

The audit report found that the Restoration Project had "major weaknesses . . . that could 

1-70 

potentially hinder regulatory compliance and the achievement of the project's overall goals." 
It said that resources dedicated to the project "appeared insufficient to deliver the quality and 
timeliness required," and clients engaged in high risk businesses "had not been identified for 
inclusion" in the project. It noted that visit reports were incomplete and, in some cases, 
"created without visits being made." 380 The audit report also stated: 

"The impact of account cancellation on the business, customers and costs should be 
analysed against the risks that have been mitigated and accepted, as this will allow having 
adequate balance between control and business, particularly where cancellations may be 
attributable to internal errors rather than to the customers." 381 



This recommendation appears to suggest that some high risk accounts not be closed, even 
where the bank was unable to review the account by the regulatory deadline and KYC 
deficiencies might exist. Mr. Thomson's email indicated, however, that unremediated files for 
PEP and SCC clients subject to the Restoration Project were already in the process of being 
closed. 382 In addition, Mr. Rendall reported to the Latin American regional audit committee that 
"7,941 KYC files for high risk customers had been reviewed & updated, or scheduled for 
closure." Mr. Rendall also reported that in the second phase of the project, "47,000 accounts 
with various risk flags" were being reviewed, with plans for a third phase to examine "83,000 
accounts with historic CAMP alert profiles." These figures were well below, however, the 1.8 
million in high risk accounts that were supposed to be reviewed to ensure KYC documentation 
met CNBV requirements. 

November Meeting with CNBV. On November 26, 2008, a high level meeting took 
place between HSBC and CNBV. Michael Geoghegan, HSBC Group CEO, traveled to Mexico 
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to attend. Along with Emilson Alonso, head of HSBC Latin America, and Luis Pena, head of 
HSBC Mexico, Mr. Geoghegan met with the President of CNBV, Guillermo Babtz; the head of 
CNBV bank supervision, Patricio Bustamante; and the head of CNBV AML oversight, Pablo 

O OA 

Gomez. The focus of the meeting was expected to be the actions taken by HBMX to address 
the CNBV concerns identified in February 2008. 

According to an email prepared by the Deputy Head of HSBC Group Compliance, 
Warren Learning, who had accompanied Mr. Geoghegan to Mexico and remained there for 
several days, the CNBV officials acknowledged the "significant progress" made by the bank, 
but remained "very concern[ed]" about the U.S. dollar accounts at HBMX's Cayman branch, the 
slow KYC review of those accounts, and the "sheer volume of US Dollars that HBMX 
repatriates" to the United States. 386 The email noted that, between January and September 2008, 
HBMX had repatriated $3 billion to the United States, which represented 36% of the market and 
double what the biggest bank in Mexico, Banamax, had repatriated, even though HBMX was 

387 

only the fifth largest bank in the country. According to the email, CNBV officials were also 
"concerned that when-ever there is a serious MLD [Money Laundering Deterrence] scheme 
HSBC seems to be involved" and that "USA authorities are concerned at the very high levels." 388 
Mr. Geoghegan told the Subcommittee that his meeting with the Mexican regulators did not go 
as he had expected, he told the CNBV that HBMX would address the issues raised, and he 
immediately took action to ensure that happened. 389 

Stopping U.S. Dollar Services. After the meeting, Mr. Alonso sent an email to Mr. Pena 
asking him to examine the "export of cash USD to the USA," including the volumes of U.S. 
dollars being exported, the types of clientele using the HBMX branch network to make U.S. 
dollar deposits for remittance to the United States, and the branches involved in more frequent 
deposits or higher volumes. 390 He also called for the "[immediate elimination of this kind of 
service in our branches. Corporate clients that require such service should be approved by you 
on a very exceptional basis." 91 

Later that same night, Mr. Geoghegan sent an email to Mr. Alonso stating: "It occurs to 
me: We should stop any Dollar remittances or accept any Dollar payments unless they are done 
via a customer's account. We should stop shipping Dollars." He also wrote: "We should 
bench mark HBMX CAMP and other search engine systems with HBUS (they have some very 
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sensitive behavior monitors) and see whether we are finding as many suspicious transactions as 
we should be." Mr. Alonso forwarded the email to Mr. Pena, who responded the next day: 

"The two immediate actions we are taking are: 

Starting December 1 . We will no longer buy or sell dollars in cash at ANY branch 
(customers or non customers). We will, as an alternative, offer travelers cheques to 
customers only. Also customers can withdraw dollars at HSBC ATMs located at airports 
or from any ATM in the world with their debit card. 

Starting January 1. We will no longer accept deposits of cash dollars to any dollar 
account at any branch. 

We are quantifying the impact of lost revenues. On the flipside, we will save the 
operating cost of transporting and exporting dollar bills. 
This should take care of the problem." 393 

Mr. Pena also proposed continuing indefinitely the freeze on opening new U.S. dollar 
accounts through HBMX's Cayman branch, and prohibiting the acceptance of new cash deposits 
for the existing Cayman accounts. 394 HSBC Group Compliance Deputy Head Warren Learning 
noted in an email to his supervisor, David Bagley, that when Mr. Pena commented that the 
actions being taken "could result in lost profits of many billions Mike[']s clear response [was] 
that nothing is worth risk to our reputation." Mr. Learning also wrote that the proposed 
actions were "considered extremely sensitive here in Mexico and local management want to get 
their ducks in a row ... so it will be much appreciated if the above could not be . . . disseminated 
without discussing further." 

Account Closing Backlog. Mr. Learning also noted that "there appears to be a huge 
back-log in closing accounts," with customers continuing to use accounts in November that had 
been ordered closed eight months earlier in March. He wrote that those accounts, which were 
still being used by customers, may be "part of the reasons for multiple SARs" being filed for 
some accounts, potentially putting HBMX in breach of HSBC policy on account closure after 
multiple SARs. 396 

Mr. Bagley responded: "What I find most frustrating is the way in which new issues 
constantly emerge however much time is spent with HBMX." He continued: "The practice of 
changing USD in the branches pres[u]mably with little or no ID for non customers is in breach of 
Group policy. When looking at our USD exposure how can this have been missed." He also 
asked Mr. Learning to consider challenging the involvement of the Legal Department in the 
account closing process so that it could proceed more quickly. 
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The next day, November 28, 2008, Mr. Geoghegan sent an email to top HBMX and 
HSBC Group Compliance officials stating that it should be made clear to all HBMX personnel 
"that if there are persistent breaches of KYC in a particular branch, the branch will be closed and 
all staff dismissed regardless of how much business we will lose on account of it." He also 
required HBMX's compensation scorecard to include implementing the CAMP monitoring 
system to the maximum extent possible and closing accounts with two or more SARs. He wrote: 
"[I]f you demonstrate zero tolerance of lapses in implementing KYC then the operations 
standards of the whole business improves at the same time. What we are doing in Mexico needs 
to be copied everywhere else in the region." 399 



AML Shock Plan. Mr. Pena responded that in January 2009, he was planning to close 
two branches and fire all staff "as exemplary measures" and was working to identify the 
branches. 400 This measure was later referred to as the "AML Shock Plan." 401 Mr. Pena also 
wrote: 



"Last but not least, I will address the issue of funding. After all, Cayman and Mexican 
dollar accounts provide us with US$2.6 billion of cheap funding. We are likely to lose a 
big portion of this if we tell customers we no longer receive dollar notes. We have to 
provide an alternative to our customers for this: Miami accounts may be an alternative 
but we will have to talk to HBUS of how we get this ch[eap] funding back to Mexico to 
lend." 402 



In December 2008, at the conclusion of his latest visit to Mexico, Mr. Learning drafted a 
letter to Mr. Pena summarizing a number of AML issues and sought input from other HBMX 
officials before finalizing it. His draft letter discussed the late filing of SARs, the backlog in 
closing accounts, the failure to close accounts after two SAR filings, slow and weak decisions by 
the CCC Committee, the need to clarify transaction limits, and the need for further refinement of 
the CAMP alert system. He noted that the account closing backlog consisted of over 3,600 
accounts, of which 675 involved suspicion of money laundering and had been ordered closed by 
the CNBV, yet were still open. He also noted that 16 of the accounts remaining open had been 
ordered closed in 2005, 130 in 2006, 172 in 2007, and 309 in 2008. He wrote that he'd been 
advised that the law did not permit the accounts to be blocked pending closure, which meant 
account activity was continuing. To speed up closures, he advised that his research had indicated 
the Legal Department did not have to participate and clients could be notified of the account 
closing by certified mail. Mr. Learning also noted that 3,000 Cayman accounts had been 
proposed for closure which would further stress the process. In addition, he warned that the 
switch from U.S. dollar deposits to travelers cheques could also raise AML concerns, advised 
lowering the $25,000 ceiling on the amount of travelers cheques that could be purchased by a 
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customer, and creating a new limit on the amount of travelers cheques that could be deposited at 
one time to a client account. He recommended setting dollar limits on cashiers cheques as well. 

Later in December, HBMX prepared to implement the new AML policies and procedures 
and close suspicious accounts. 404 December 22 and 24 were set as the dates to close four HBMX 
branches "as disciplinary actions," with another 10 to 20 branches that, in January, would have 
all staff dismissed. 405 January 1, 2009 was set as the date to stop buying or selling U.S. dollars at 
HMBX branches. 406 It was also the date set for closing all accounts opened by casas de cambios. 
January 31 was set as the date to complete the Restoration Project and begin closing accounts 
that had incomplete documentation or were subject to at least two SAR filings. 407 

On December 22, 2008, an HBMX employee alerted the HBUS regional head of 
Banknotes, Gyanen Kumar to the HBMX's plan to stop buying and selling U.S. dollars in the 
new year. 408 Mr. Kumar forwarded it to the Banknotes head Christopher Lok with the comment: 
"I have not been told anything firm as to why this decision is being taken as much as it is a 
drastic change. My instincts tell me that perhaps this has something to do with compliance." 409 
HBMX apparently did not explain, leaving HBUS uninformed about the compliance and 
regulatory pressures and AML risks behind HBMX's decision to end its U.S. dollar business. 

Law Enforcement and Regulators Converge. In January 2009, HBMX began 
implementing the planned AML changes. It stopped buying and selling U.S. dollars and began 
closing accounts held by casas de cambio. 410 

That same month, U.S. regulators began contacting HBUS to get clarification about 
HBMX's decision to stop buying and selling U.S. dollars. 411 When asked, HBMX told HBUS 
the decision had been based primarily on cost considerations, without mentioning the compliance 
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and AML concerns that led to the decision. The regional head of HBUS' Banknotes 
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department, Gyanen Kumar, who was traveling to Mexico the next week, was asked by his 
colleagues to get more information. 413 On January 13, HBMX sent HBUS a copy of its internal 
press release describing its decision. 414 Based upon HBMX's actions, HBUS decided to close 
banknotes accounts used by two Mexican clients, but to retain accounts with the same clients in 
the Payments and Cash Management (PCM) division. 415 Closing the banknotes accounts meant 
that the Mexican clients could no longer make bulk cash sales of their U.S. dollars to HBUS, but 
the continued operation of their PCM accounts meant that both Mexican clients could still 
deposit U.S. dollars, execute U.S. dollar transactions, exchange U.S. dollars for Mexican pesos, 
and access the U.S. wire transfer system. 

Around the same time, the Immigration and Customs Enforcement (ICE) arm of the U.S. 
Department of Homeland Security (DHS) held a meeting with HBUS in New York, and 
informed it that ICE was conducting an investigation of a particular Mexican casa de cambio that 
had accounts at both HBUS and HBMX. 416 HBUS apparently did not relay that information to 
HBMX. 

Six months later, in June 2009, HSBC Group increased its risk assessment for its Latin 
American operations to its highest risk rating. 417 When Emilson Alonso, HSBC Latin America 
head, protested, HSBC Group Compliance head David Bagley explained: 

"I fully acknowledge the level of priority and focus that you and the team have given to 
these issues and the progress that has been made particularly in Mexico and have taken 
all of this into account. . . . 

The basis for the rating is however: 

The inherent AML risk in Mexico is still very high and [t]here are not many other parts 
of the Group that have what is effectively a drugs war being conducted on the streets and 
also have the risk posed by potential sting and other operations by the US authorities. 
We have of course remediated our high risk accounts, but the historic weak account 
opening processes mean that we have overall lower levels of KYC across the customer 
base as a whole." 418 

A week or so later, HBUS suddenly reclassified Mexico from its lowest to its highest risk rating. 
HBMX personnel in Mexico protested, but HBUS did not change its rating. One consequence 
was that its Mexican clients were automatically deemed to be located in a high risk country, 
triggering enhanced scrutiny. 



4U Id. at HSBC OCC 3633811. 

414 Id at HSBC OCC 3633809. 

415 Id. at HSBC OCC 3633811, 807. 

416 Id at HSBC OCC 3633806. HSBC Group Compliance head David Bagley remarked near the end of January: 
"An obvious learning point for HBMX is that if they were contacted by US authorities then they should have 
thought to advise HBUS. They can go round the web, not just through the middle of the web. 1/30/2009 email from 
HSBC David Bagley to HSBC Susan Wright, "US issues - Various," HSBC OCC 8873759. 

417 See 6/9/2009 email from HSBC David Bagley to HBMX Emilson Alonso, copies to HSBC Michael Geoghegan 
and others, "GMO Business reviews - LATAM," HSBC OCC 8874895. 



78 



Later in June 2009, ICE contacted HBMX about its investigation into a particular 
Mexican casa de cambio that had an account at the bank. 419 A few days later, ICE contacted 
HBUS' primary U.S. regulator, the OCC, and alerted the OCC to its investigation. 420 As a result, 
the OCC began intensifying its regulatory scrutiny of HBUS, in particular with respect to its U.S. 
banknotes business, which U.S. regulators later said had increased as HBMX's decreased. 421 

In the meantime, AML deficiencies continued to surface at HBMX. For example, in June 
2010, HBMX noted that "certain transaction types were not being captured" by its AML account 
monitoring system, CAMP, and "therefore were not being monitored." 422 HBMX also noted that 
the CAMP software had not been updated "since its installation in 2005." In September 2010, 
the OCC issued a Supervisory Letter detailing massive AML deficiencies at HBUS, derived in 
part from its dealings with Mexico. The OCC followed with a cease and desist order in October. 

Eight Years of HBMX AML Deficiencies. HBMX and HSBC Group internal 
documents demonstrate that HBMX's AML deficiencies were longstanding and widespread. 
Audit after audit detailed long lists of problems, including inadequate compliance resources, 
missing KYC information, manufactured site visits, inadequate account monitoring, unread 
alerts, poor training on the monitoring system and assigning SCC designations, internal disputes 
over closing accounts with suspicious activity, accounts left open despite multiple SARs and 
orders by regulators to close them, a SAR filing backlog, and an account closure backlog that 
spanned three years. AML leadership at HBMX was also weak. One AML director was 
dismissed for manufacturing notes of AML committee meetings that never took place; another 
was dismissed for inadequate performance; several long periods went by without any AML 
director in place at all. Even AML projects with resources and high level backing were 
unsuccessful, such as the Restoration Project which reported in 2008, that 75% of high risk client 
files still had inadequate KYC documentation. 

The evidence obtained by the Subcommittee shows that HSBC Group was fully aware of 
the years-long, substantial AML and compliance problems at HBMX, originating with the bank's 
purchase in 2002. The evidence also indicates that HSBC Group executives and compliance 
personnel worked to build a compliance culture, but repeatedly faced a workforce in Mexico that 
disregarded the Group's AML policies and procedures, delayed obtaining required KYC data, 
delayed closing suspect accounts, and delayed reporting suspicious activity to regulators. In 
2009, under pressure from regulators, HSBC Group took drastic measures, including prohibiting 
HBMX branches from buying or selling U.S. dollars, shuttering entire branches with checkered 
histories, and scheduling for closure thousands of accounts with incomplete KYC 



419 See 6/28-29/2009 summary of telephone conversations, prepared by OCC Joseph Boss, OCC-PSI-00928759-761. 

420 Id. 

421 Paul Thurston told the Subcommittee that, in retrospect, while HBMX's banknotes business appeared to be 
declining, HBUS' banknotes business with Mexico had been increasing at the same time, due to its banknotes 
business with HBMX and former clients of HBMX. Subcommittee interview of Paul Thurston (5/1/2012). 

422 See 6/18/2010 email from HBUS Michael Anderson to HBMX Ken Harvey, with copy to Andrew Zissell, 
"RMM action point," HSBC OCC 8875492-493 (attaching Compliance Report on Mexico, numbered 53.2.1). 
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documentation. Even with those actions, HSBC Group acknowledged internally that HBMX 
continued to pose a high risk of money laundering to the Group. 423 

The evidence also indicates that while HSBC Group was fully informed about HBMX's 
AML and compliance deficiencies, little of that information was conveyed to HBUS, despite 
HBMX' extensive correspondent relationship with HBUS. When asked about the lack of 
communication, HBMX CEO Paul Thurston indicated that he reported HBMX's AML problems 
to HSBC Group and believed Group would communicate necessary information to HBUS. 424 
HSBC Group CEO Michael Geoghegan told the Subcommittee that HBMX problems were 
discussed at HSBC Group Management Business (GMB) meetings, which HBUS CEO Brendan 

425 

McDonagh attended, so he thought HBUS was aware of the problems. ^ HSBC Group 
Compliance head David Bagley told the Subcommittee that Group Compliance could have 
informed HBUS Compliance about the problems at HBMX, but "we did not think of it." 426 
Instead, he reported the information to HSBC Group's senior management. Several senior 
HBUS executives told the Subcommittee that the bank was not informed of the extent of AML 
problems at HBMX. The result was, at the same time HBUS was handling hundreds of billions 
of dollars in cash transactions for HBMX, processing U.S. dollar wire transfers, clearing U.S. 
dollar travelers cheques, and opening U.S. dollar accounts for HBMX clients, HBUS was left in 
the dark by its own colleagues about the extensive AML and compliance problems at HBMX. In 
addition, in conformance with HSBC Group policy and practice, HBUS conducted no due 
diligence assessment of HBMX, did not evaluate its riskiness, did not review its audit findings, 
and did not monitor its wire transfers, cash letter activity, or banknotes transactions for 
suspicious activity. HBUS had rendered itself blind to the fact that it was servicing a high risk 
financial institution. 

D. HBMX High Risk Clients 

HBMX made extensive use of its correspondent relationship with HBUS. From its 
acquisition in 2002, HMBX worked with HBUS's Payments and Cash Management (PCM) 
division and, until 2010, with HBUS' Global Banknotes division, both headquartered in New 
York. HBMX used its correspondent and banknotes accounts to process U.S. dollar wire 
transfers, clear U.S. dollar monetary instruments like travelers cheques, and deposit bulk cash 
shipments of U.S. dollars on behalf of itself and its clients. Three examples of HBMX high risk 
clients help illustrate how HBMX's AML deficiencies also created risk for HBUS. They include 
high risk Mexican and U.S. money service businesses, clients using offshore U.S. dollar accounts 
in the Cayman Islands, and purchasers of millions of dollars in U.S. dollar travelers cheques. 

(1) High Risk Money Service Businesses 

Mexican casas de cambio (CDCs) are money service businesses licensed by the Mexican 
Treasury Department (SHCP), through the CNBV, to exchange foreign currencies for a fee. In 



See, e.g., 6/9/2009 email from HSBC David Bagley to HBMX Emilson Alonso, copies to HSBC Michael 
Geoghegan and others, "GMO Business reviews - LATAM," HSBC OCC 8874895. 

424 Subcommittee interview of Paul Thurston (5/1/2012). 

425 Subcommittee interview of Michael Geoghegan (5/24/2012). 

426 Subcommittee interview of David Bagley (5/10/2012). 
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Mexico, CDCs are not licensed as banks and do not hold deposits, maintain checking or savings 

427 

accounts, or provide other banking services. Instead, CDCs are typically limited to accepting 
currency from a customer, exchanging it for another currency, and then either handing it over to 
the customer or wiring it to a financial institution in another country, such as the United 



In the United States, some money service businesses perform similar cross-border 
services, enabling individuals in the United States to wire U.S. dollars to Mexico, where the 
dollars may be converted into Mexican pesos and paid out to a designated recipient. Those U.S. 
money service businesses are sometimes referred to as money remitters. Both Mexican CDCs 
and U.S. money service businesses often perform their services for walk-in customers, although 
they may also have established customers who use their services on a regular basis. In both 
Mexico 429 and the United States, 430 CDCs and money service businesses are legally required to 
establish AML programs to safeguard against laundering criminal proceeds. 



(a) Casa de Cambio Puebla 

Until 2007, Casa de Cambio Puebla (Puebla) was a licensed casa de cambio, founded in 
1985, with branch offices throughout Mexico. 431 On May 16, 2007, the United States obtained a 
warrant from a federal court in Florida and froze or seized all Puebla funds on deposit with 
Wachovia Bank in Miami, as well as with Wachovia Bank in London, affecting funds totaling 
over $11 million. In July 2007, Puebla filed a civil complaint seeking the release of those 
funds. 433 In 2008, the United States indicted Puebla, two of its officers, 434 and two other 
individuals on drug smuggling and money laundering charges. 435 In 2009, one of the defendants 
was arrested and, in 2010, pled guilty to conspiracy to launder money, 436 and was sentenced to 
14 months in prison, while the other defendants, including Puebla, were placed on fugitive 

437 

status. In addition, in 2010, Wachovia Bank entered into a deferred prosecution agreement 
with the U.S. Department of Justice for having failed to maintain an effective anti-money 

438 

laundering program in connection with its casa de cambio business, including with respect to 



42/ See United States v. Wachovia Bank N.A. , Case No. 10-201 65 -CR-Lenard (USDC SDFL), Factual Statement, 
Exhibit A to Deferred Prosecution Agreement (3/16/2010), at f 12. 

428 See United States v. Wachovia Bank N.A. , Case No. 10-20165-CR-Lenard (USDC SDFL), Factual Statement, 
Exhibit A to Deferred Prosecution Agreement (3/16/2010), at f 11. 

429 See Article 95 bis of the General Law of Auxiliary Credit Organizations. 

430 See 31 USC § 5318(h)(1) and § 5312(J) and (R). 

431 Casa de Cambio Puebla, S.A. v. United States , Case No. 10-20165 (USDC SDFL), Petition for Return of Seized 
Funds (7/12/2007)(hereinafter "Puebla Petition"), at 4. 

432 Puebla Petition, at 2-3. 

433 Id. 

434 See id. at 19. 

435 See United States v. Casa de Cambio Puebla, S.A., Jose A. Gutierrez de Velasco Hovos, Amador Cordero 
Vasquez, Pedro Alfonso Alatorre Damy, a/k/a "Pedro Barraza Uruguastegui," and Leonardo Vasquez Estrada , Case 
No. 08-20097-CR-Graham (USDC SDFL), Indictment (2/1/2008, unsealed 1 1/4/2009). 

436 Id., Plea Agreement (7/9/2010) at f 1. 

437 See id., docket entries 12, 34, 38-42. 

438 United States v. Wachovia Bank N.A. , Case No. 10-20165-CR-Lenard (USDC SDFL), Deferred Prosecution 
Agreement (3/16/2010), at I 3. 
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Puebla. Those legal proceedings, which involved a major Mexican CDC and major U.S. 
bank, received widespread attention. 440 

Puebla was a longtime customer of HBMX, having first begun a relationship with 
HBMX's predecessor, Bital, in the 1980s. 441 In 2004, Puebla also opened a U.S. banknotes 
account with HBUS. 442 By 2007, Puebla had several accounts at HBMX, as well as an 
outstanding loan. 443 After the United States seized the company's funds at Wachovia Bank in 
May 2007, HBUS suspended the Puebla account two weeks later and closed the account in June 
2007. 444 HBMX did not actually close the account until November 2007, and then only after the 
Mexican Attorney General served an order on the bank seizing Puebla funds. 

Puebla at HBMX. At the time of the May 2007 seizure of more than $11 million in 
Puebla funds at Wachovia Bank, HBMX was already reeling from another money laundering 
scandal involving a March 2007 seizure of cash, weapons, and wire transfer records from the 
Mexican residence of longtime customer, Zhenly Ye Gon and his pharmaceutical companies, 
Unimed Pharm Chem, Constructora e Inmobiliaria Federal, and Unimed Pharmaceutical. 445 That 
seizure had triggered an intensive review by senior HBMX officials of the Ye Gon-related 
accounts as well as HBMX's overall AML program. The Puebla case added another high profile 
problem for HBMX, not least because Puebla also handled Ye Gon funds. 446 

In late May 2007, HBUS learned of the seizure of Puebla funds at Wachovia Bank, and 
quickly suspended activity in the Puebla correspondent account at HBUS. 447 It is not clear when 
HBMX first learned of the seizure, but by early June, both banks were considering whether to 
close their Puebla accounts. On June 5, 2007, Leopoldo Barroso, HBMX's AML head, received 



iv Id., Factual Statement, Exhibit A to Deferred Prosecution Agreement (3/16/2010), at f 11. 

440 See, e.g., "U.S. freezes Mexico exchange bureau accounts for money laundering," EFE News Services Inc. 
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441 See, e.g., July 2007 email exchanges among HBMX Paul Thurston, John Rendall, Ramon Garcia, and others, 
"[subject redacted by HSBC], HSBC OCC 8875132-135. 

442 See 6/5/2007 email from HBUS Daniel Jack to HBMX Leopoldo Barroso, "HSBC in Mexico - AML 
Compliance & Casa de Cambio," HSBC-PSI-PROD-0095913. 
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HBUS Denise Reilly, "Wall Street Journal Article Regarding Wachovia," OCC-PSI-01358515. 
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Extradition (9/15/2008) (hereinafter "Ye Gon Extradition Complaint"), at 13; "Mexican Fugitive and Co- 
Conspirator Arrested on U.S. Drug, Money Laundering Charges," U.S. Drug Enforcement Administration press 
release (7/24/2007), http ://www. j ustice . go v/dea/pubs/states/ne wsrel/wdo072407 .html . 

446 See 10/13/2007 "Reportan ruta de Ye Gon para 'blanquear' dinero" ("Ye Gon reported path to 'launder' 
money"), El Universal , Francisco Gomez, www. eluni versal .com. mx (reporting that the Mexican agency SHCP had 
determined that, from 2003 to 2006, Mr. Ye Gon and his companies had moved $90 million through four major 
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(Update) for Consultoria Inernacional Banco, prepared by HBUS Financial Intelligence Unit, OCC-PSI-00247712. 

447 See 5/31/2001 email from HBUS Alan Ketley to HBUS Gyanen Kumar and others, "With immediate effect we 
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an email from a senior AML Compliance officer at HBUS, Daniel Jack, asking if Mr. Barroso 
was the new AML director at HBMX and "wonder[ing] what relationships" HBMX had with 
Puebla. 448 Mr. Barroso responded that HBMX had "a few DDAs [Demand Deposit Accounts] 
and a loan" with Puebla. 449 He also indicated that HBMX planned to "decide within the next 5 
days" whether to terminate its relationship with Puebla, and asked Mr. Jack to let him know if 
HBUS decided to take that action. 450 



Mr. Jack noted in a later email that he did not tell Mr. Barroso during the June 5 email 
exchange about "the DEA seizure or Wachovia closing [Puebla] acc[oun]ts," although it is 
possible that HBMX already knew. 451 Mr. Jack also did not disclose that HBUS had already 

452 

suspended Puebla' s account activity a week earlier, on May 31. Mr. Jack told the 
Subcommittee that, soon after the June 5 email exchange, he told Mr. Barroso that HBUS had 
shut down its account with Puebla. 453 When Mr. Barroso asked if HBUS could provide him with 
a list of their banknote customers in Mexico and the amount of U.S. dollars they exported from 
Mexico to the United States, Mr. Jack demurred, responding that there were "privacy issues" but 
that he would "see what info" he could share. 454 This exchange between senior AML 
Compliance personnel at HBUS and HBMX suggests that information sharing between the two 
banks was guarded, rather than automatic. 

In early July 2007, HBMX Compliance head, Ramon Garcia, disclosed in an internal 
weekly report that went to HSBC Group Compliance that the HBMX CCC Committee had 
considered closing the Puebla account, but decided instead to retain the client. In response, John 
Root, head of Latin American Compliance at HSBC Group, sent him a blistering email 
criticizing the CCC Committee for "rubber-stamping unacceptable risks." This email, cited 
earlier in a discussion of HBMX's CCC Committee, is relevant again, because it applies to the 
Puebla account. Mr. Root wrote: 



"It looks like the business is still retaining unacceptable risks and the AML committee is 
going along after some initial hemming and hawing. I am quite concerned that the 
committee is not functioning properly. Alarmed, even. I am close to picking up the 
phone to your CEO." 455 

Mr. Root's email went on to harshly criticize the CCC Committee's decisions to keep 
open accounts for Mr. Ye Gon and another accountholder under suspicion for money laundering, 
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Team," "Casa De Cambio Puebla," HSBC OCC 7688742. 

453 Subcommittee interview of Daniel Jack (3/13/2012). 
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before describing as "strike three," the decision to retain the Puebla "relationship after USD1 1 
million was seized by the authority in [Redacted by HSBC] account with Wachovia in Miami." 
Mr. Root continued: 

"What?! The business was okay with this? The AML Committee just can't keep rubber- 
stamping unacceptable risks merely because someone on the business side writes a nice 
letter. It needs to take a firmer stand. It needs some cojones. We have seen this movie 
before, and it ends badly." 456 

Mr. Garcia responded that he was escalating the decision on Puebla to the HSBC Mexico 
CEO, since the relevant HBMX business division had disagreed with a Compliance 
recommendation to close the account. 7 The next week, HSBC Mexico CEO Paul Thurston 
agreed with closing the account. 458 Mr. Rendall suggested alerting their U.S. counterparts at 
HBUS, since HBUS also had a correspondent relationship with Puebla. 459 

Despite Mr. Thurston's July 2007 decision to close the Puebla account, HBMX did not 
actually close or freeze its Puebla account for another four months, allowing Puebla continued 
use of HBMX's correspondent account at HBUS. 460 HBMX finally closed the account in 
November 2007, after receiving a seizure warrant from the Mexican Attorney General seeking 
all funds in accounts opened in the name of Puebla or related parties. 461 

The seizure warrant named 91 parties related to Puebla, of which 81 were HBMX 
customers who presumably were also using the HBMX correspondent account at HBUS. 462 
HBMX later determined that, from January 1 though October 31, 2007, a period of ten months, 
approximately 650 wire transactions had cleared through the "HBSC Mexico correspondent 
account" at HBUS, where Puebla was either the originator or the beneficiary. 463 Of those 
transactions, 170 wire transfers totaling $7.3 million were conducted by six individuals or 
entities linked to Puebla. 464 All of those wires were later traced back to the Puebla accounts 
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frozen at Wachovia. The OCC later observed: "T]hese discoveries about the level of CDC 
activity should have raised concerns for HBUS and alerted the bank to the need to obtain basic 
due diligence for HSBC Mexico and other Group Entities." 466 

Puebla at HBUS. While HBMX exposed HBUS to considerable money laundering risk 
through the transactions it conducted for Puebla, HBUS also incurred risk from its own direct 
dealings with Puebla, including a U.S. banknotes account it opened for Puebla in 2004. In just 
three years, Puebla substantially boosted its use of that U.S. banknotes account, swelling its sales 
of U.S. dollars to HBUS from $18 million in February 2005, to $1 13 million in March 2007, a 
tenfold increase. 467 



When AML monitoring alerts raised red flags about the growing flood of U.S. dollars 
from Puebla, HBUS bankers provided a number of explanations for the increases, none of which 
considered whether Puebla might be accepting illegal drug proceeds that drug cartels were then 
smuggling into Mexico from the United States. For example, when Puebla' s U.S. dollar volumes 
increased by $3 million between November 2005 and February 2006, an HBUS banker wrote 
that the "[c]lient is slowing [sic] growing its business volume as a result of better cash flow 
thanks to dealing with HSBC i.e., faster turnaround of banknotes." 468 When the volume jumped 
by another $13 million the very next month, the HBUS banker offered the same explanation, 
typo and all: "[c]lient is slowing [sic] growing its business volume as a result of better cash flow 
thanks to dealing with HSBC i.e., faster turnaround of banknotes." This cut-and-paste 
explanation offers no evidence that the banker used due diligence to analyze the sudden multi- 
million-dollar increase. When the volume climbed again, by more than $20 million from April 
2006 to September 2006, to over $76 million, the HBUS banker asked for an explanation wrote: 
"Mexico as a whole and more specifically [Puebla] is the premier country/msb [money service 
business] USD [U.S. dollar] remitter. There is [a] large population of Mexican[s] working in the 
U.S. during the summer months (landscaping) that send money back home (religiously) to their 
families." 469 While that might have been true, it was equally true when Puebla transmitted just 
$27 million back to Mexico around the same time the previous year, a nearly $50 million 
difference. 470 By the end of March 2007, the month before Puebla funds were seized at 
Wachovia Bank, its monthly U.S. dollar transactions at HBUS had exceeded $113 million. 471 

On May 30, 2007, two weeks after the seizure of Puebla funds on May 16, HBUS 
ordered all activity in the Puebla account to be suspended with "immediate effect." A week 
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later, on June 5, 2007, HBUS AML Compliance officer Daniel Jack contacted HBMX to 
ascertain whether Puebla also had accounts there, which would continue to expose HBUS to the 
money laundering risks associated with Puebla through the HBMX correspondent account. 473 

HBUS terminated its Banknotes relationship with Puebla after conducting a site visit on 
June 11, 2007. 474 In June and July 2007, HBUS was contacted by multiple U.S. law 
enforcement agencies regarding its correspondent accounts with financial institutions in Mexico, 
including Puebla. On June 25, 2007, for example, the Drug Enforcement Administration and 
other law enforcement told HBUS of their interest in its "banknote trading with" Puebla. 475 On 
July 17, 2007, HBUS met with "an analyst from the National Drug Intelligence Center of the US 
Dep[artmen]t of Justice to explain our business and AML program along with discussing cross- 
border issues." 476 On July 20, 2007, HBUS met with FinCEN specialists "to discuss our 
wholesale banknotes business with clients in Mexico as well as our AML program, CTR filing 
and related issues." 477 The extent to which HBUS informed HBMX about the level of U.S. law 
enforcement interest in Puebla is unclear. 



(b) Sigue Corporation 



Another HBMX client that used HBMX's correspondent account at HBUS was Sigue 
Corporation (Sigue), a U.S. licensed money service business incorporated in Delaware but 

478 

headquartered in California. Sigue' s primary business activity was transmitting funds on 
behalf of third parties from the United States to Mexico and Latin America. 479 Acting through 
its operating company, Sigue LLC, it arranged for the remittance of U.S. dollars through a 
network of more than 7,500 "authorized delegates" across the United States, most of which were 
small businesses under contract to offer Sigue's money transmission services. 480 

On January 28, 2008, Sigue entered into a deferred prosecution agreement with the U.S. 
Department of Justice, Drag Enforcement Administration, and Internal Revenue Service, 

481 

admitting that it had failed to maintain an effective anti-money laundering program. As part 
of the agreement, Sigue admitted to "serious and systemic" violations of U.S. AML requirements 
from 2003 to 2005, which "allowed tens of millions of dollars of suspicious financial 
transactions to be conducted through Sigue, including transactions involving funds represented 
by undercover U.S. law enforcement agents to be drug proceeds." 482 The drag proceeds which 
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U.S. undercover agents transmitted through Sigue totaled more than $500,000, and were sent 
through 59 separate Sigue agents in 22 states. 4 3 The undercover agents had explicitly informed 
Sigue agents that they were transmitting illegal drug proceeds, structured the transactions to 
evade U.S. reporting obligations, and wired the funds to seven law enforcement agents in 
Mexico City, creating a money laundering pattern that Sigue should have detected and reported 
as suspicious activity, but did not. 484 Sigue admitted its failure to adequately supervise and 
control its agents, "effectively monitor and investigate high risk transactions," "establish an 
effective risk-based AML program," and "exercise sufficient enhanced due diligence for high- 
risk transactions and customers." As part of the agreement to defer prosecution of the 
company, Sigue agreed to forfeit $15 million in suspect funds and spend $9.7 million to 
strengthen its AML program. 

The day after the deferred prosecution agreement was made public in court, an article 
discussing Sigue' s misconduct and "record penalty" concluded that a "case such as that against 

487 

Sigue gives banks yet another reason to treat MSBs [money service businesses] as pariahs." 
David Bagley, HSBC Group Compliance head, sent a copy of the article to Susan Wright, head 
of AML Compliance for HSBC Group, with a handwritten note: "Obvious question - I assume 
they are not our customer." 488 His assumption, however, was incorrect. 

After learning that Sigue was, in fact, a client of HBMX, on February 1, 2008, Ms. 
Wright sent an email to HBMX Compliance head Ramon Garcia about the account. 489 She noted 
that, despite the deferred prosecution agreement and Sigue' s admission of wrongdoing, HBMX's 
commercial banking division wanted to retain the account. She warned that, if the account were 
retained, it: 

"will need to be closely monitored and subject to frequent reviews (recommendation for 
quarterly reviews in current circumstances). The actions by the US regulators should be 
used as a trigger event and our due diligence on this client updated. In this connection 
the high risk profile that is in place for Financial Institutions should be used. ... If we 
only see batched transactions then we are relying on the screening undertaken by [Sigue] . 
It would be helpful to understand the nature of these transactions and currencies involved 
- could you provide me with an overview? We should also monitor the volume - you 
mentioned that we are not [Sigue' s] only bankers in Mexico. If, however, any of the 
other banks withdraw then we may well see the volume of transactions through us rise 
and our exposure/risk will increase with a corresponding increase in the cost of 
monitoring, etc." 490 



483 Id. 

484 Id. at 1-3. 
485485 Id. at 6. 

486 Id. at 12-15; Deferred Prosecution Agreement at fit 5, 9. 

487 "Money Laundering 'Sting' led to MSB's Record Penalty, Says Legal Pact," Complinet , Brett Wolf, (1/29/2008), 
reprinted at HSBC OCC 8875020. 

488 See handwritten note on copy of article, "Money Laundering 'Sting' led to MSB's Record Penalty, Says Legal 
Pact," Complinet , Brett Wolf, (1/29/2008), HSBC OCC 8875020. 

489 2/1/2008 email from HSBC Susan Wright to HBMX Ramon Garcia, with copies to HSBC Warren Learning and 
John Root, no subject line, HSBC OCC 8875017-018. 

490 Id. 
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Her email was forwarded to HSBC Compliance head David Bagley who, on February 4, 
2008, forwarded it to HBMX CEO Paul Thurston and recommended closing the Sigue 
account. 491 Mr. Bagley noted Sigue' s "serious and systemic violations and a record fine" due in 
part to the fact that Sigue "had little control over its numerous agents." He wrote: "Whilst the 
company will now need to take steps to address these deficiencies this will inevitably take some 
time, and instilling the appropriate culture within the business even longer." 

Mr. Thurston forwarded Mr. Bagley' s recommendation to John Rendall, HBMX COO, 
and asked for more information about the account. 492 Mr. Rendall reminded him that "a couple 
of months back," HBMX Compliance had recommended closing the Sigue account, but was 
opposed by the HBMX commercial banking division (CMB) that wanted to keep the account 
open. 493 The issue was then elevated to Mr. Thurston who decided against closing the 
account. 494 Mr. Rendall explained: 

"Our recommendation, which you supported, was to maintain this relationship. It was 
based on the following factors: A) our CMB team in Tijuana were relatively on the top 
of the case; B) the events for which [Sigue] have been fined were relatively historic - 
from memory, 2-3 years ago, and significant improvements had been made since 



Despite Sigue' s admission of wrongdoing, its admission of lax controls over the actions taken by 
its agents, and the recommendation of the head of HSBC Group Compliance to close the 
account, Mr. Thurston decided once again to retain it and to continue to provide Sigue with U.S. 
dollar transactions through the HBMX accounts at HBUS. 

Mr. Thurston told the Subcommittee that Sigue was one of the few accounts he decided 
to retain over the objection of HBMX Compliance. He explained that he did so, because he 
believed the issues were in the past, and Compliance head Ramon Garcia had met with Sigue and 
believed it was meeting its commitment to strengthen its AML program. 496 

Also on February 4, 2008, after reviewing an earlier media report identifying HBMX as a 
"pay partner" for Sigue, 497 the OCC AML Examiner then reviewing HBUS' AML program 
"requested HSBC management to determine what, if any, involvement HSBC had with 



491 2/4/2008 email from HSBC David Bagley to HBMX Paul Thurston, [subject redacted by HSBC], HSBC OCC 
8875016. 

492 See 2/4/2008 email from HBMX John Rendall to HBMX Paul Thurston, "[redacted by HSBC]," HSBC OCC 
8875139. 

493 See 2/4/2008 emails from HBMX John Rendall and HBUS David Bagley, "[redacted by HSBC]," HSBC OCC 
8875139-40. 

494 See 2/4/2008 email from HBMX John Rendall to HBMX Paul Thurston, "[redacted by HSBC]," HSBC OCC 
8875139. 

495 See 1/2/2008 email from HBUS Susan Wright to HBMX Ramon Garcia, "[redacted by HSBC]," HSBC OCC 
8875141. 

496 Subcommittee interview of Paul Thurston (5/1/2012). 

497 See "California MSB Faces Record Fine From Justice Department in AML Case," Fortent Inform , Brian Monroe 
(1/1 1/2008); see also 2/5/2008 OCC memorandum to files, "HSBC Monitoring/Reputation Risk," OCC-PSI- 
01416736 [sealed exhibit]. 
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Sigue." The OCC inquiry triggered an inquiry into the Sigue account by HBUS, which had 
not been privy to the exchanges between HSBC Group and HBMX about the account. 499 

On February 5, 2008, HBUS informed the OCC AML Examiner that while Sigue was not 
an HBUS client, it was a client of HBMX and had executed U.S. dollar wire transfers through 
HBMX's correspondent accounts at HBUS. 500 In an internal memorandum summarizing the 
information, the OCC AML Examiner wrote that HBUS "acts as a pass-through for wire 
transfers for Sigue." 501 He noted that, for "the period of January through December 2007 159 
wire transfers passed through HSBC originated by Sigue for the benefit of HBMX, involving 
more than $485 million. 502 He wrote that HBUS management had agreed that those wires should 
have triggered a review of the account activity. 503 

The OCC AML examiner saw the events surrounding the Sigue account as emblematic of 
a broader problem involving inadequate monitoring and weak AML investigations by HBUS of 
clients using correspondent accounts to conduct suspect transactions. In the internal 
memorandum, the OCC AML examiner wrote: 

"Over the past few years, there have been a number of instances where the OCC has 
brought to the attention of HSBC management negative media events, publicized 
indictments, etc., resulting in the need for HSBC management to conduct ad-hoc reviews 
to determine potential reputational risk. In the majority of these instances, HSBC 
management was either not aware of these events or had not been pro-active in 
determining the level of potential exposure due to these events." 504 

He concluded that if he had "not intervened it is highly unlikely that HSBC management would 
have performed the proper level of due diligence, [or] determined the potential exposure to risk" 
in the Sigue matter. 505 

Two months later, on April 26, 2008, a major U.S. newspaper published an article 
describing an ongoing federal probe of allegations that Wachovia Bank was laundering drug 
proceeds supplied by Mexican casas de cambio. The article also mentioned Sigue, triggering 
a second round of inquiries at HBUS into the status of the Sigue account which remained open at 



498 2/5/2008 OCC memorandum to files, "HSBC Monitoring/Reputation Risk," OCC-PSI-01416736, at 2. [Sealed 
Exhibit.] 

499 The OCC Examiner noted internally at the time: "Although HSBC management was previously aware of media 
reports concerning Sigue, up to the time of our request, HSBC management had not conducted any enhanced due 
diligence and/or in-depth analysis to determine HSBC's potential exposure resulting from the prosecution of Sigue." 
Id. at 2 (emphasis in original omitted). 

500 See 2/5/2008 OCC memorandum to files, "HSBC Monitoring/Reputation Risk," OCC-PSI-01416736, at 3. 
[Sealed Exhibit.] 

501 Id. 

502 Id. HBUS apparently provided this wire transfer information to the OCC, in response to the OCC request for 
more information about HBUS' involvement with Sigue. 

503 Id. 

504 Id. 

505 Id. all. 

506 See "Wachovia Is Under Scrutiny in Latin Drug-Money Probe," Wall Street Journal , Evan Perez, Glenn Simpson 
(4/26/2008). 
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HBMX and continued to execute U.S. dollar transactions through the HBMX correspondent 
account at HBUS. 

HBUS AML Compliance officer Judy Stoldt and HBUS investigator Gloria Stazza sent a 
memorandum to their supervisor Denise Reilly, a senior HBUS AML Compliance officer, 
summarizing the article and discussing HBUS' exposure to the casas de cambio named in the 
article, including Sigue. 507 The memorandum began: 

"HBUS does not hold any account for any casa de cambio mentioned in the WSJ article. 
The only HBUS connection to activity involving those named casas de cambio is activity 
that was conducted through our correspondent accounts, and most notably through our 
account with HSBC Bank Mexico (HBMX)." 508 

The May 2008 memorandum described Sigue as a money service business that had 
allegedly processed $24.7 million in "suspicious money remittances related to drug-trafficking 
proceeds." 509 It explained that HBUS had first taken note of Sigue when it entered into a record 
$25 million settlement with the Justice Department in January 2008, and, as a result, conducted a 
review of the Sigue accounts, wire transfer activity, and whether either Sigue or its founder, 
Guillermo de la Vina, had been "the subject of any other negative news or law enforcement 
activity." 510 The memorandum reported that, despite having no direct account with Sigue, a 
"wire review" found that, during 2007, Sigue had sent 159 wire transfers for $485 million 
through HBMX's correspondent account, all of which were originated by Sigue and sent to its 
own account at HBMX, which HBUS viewed as suspicious. 511 The memorandum noted that 
HBUS had contacted HBMX to discuss Sigue, and HBMX disclosed that it had imposed 
"parameters" on its relationship with Sigue, including limiting Sigue to "conducting transactions 
for individual customers to $2,000 USD per transaction." 512 The memorandum did not explain, 
however, how that $2,000 limit affected the actual wire activity in 2007, in which each wire 
transfer apparently batched numerous underlying wires without identifying individual client 
transactions. The memorandum also stated that HBUS had found that a Sigue employee had 
been indicted for assisting drug traffickers with money laundering, and on another occasion 
Sigue was described as having allowed $295,000 to be transferred from an account at another 
bank to an illegal alien in Mexico. Despite this cascade of troubling information, for the next 
two years, little or no action appears to have been taken by HBUS or HBMX with respect to the 
Sigue account at HBMX. 



507 See 5/1/2008 memorandum [carrying incorrect date of 5/1/2007] from HBUS Judy Stoldt and Gloria Stazza to 
HBUS Denise Reilly, "Wall Street Journal Article Regarding Wachovia," OCC-PSI-01358516-517. 

508 Id. at 1. 

509 Id. at 3. 

510 Id. 

511 Id. at 4. The memorandum did not mention that this wire analysis was compiled for the OCC, at its request, in 
February 2008. 

512 Id. at 4. 

513 Id at 3-4. 
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On January 30, 2009, having determining that Sigue satisfied the requirements of the 
Deferred Prosecution Agreement the Justice Department requested and the court granted 
dismissal of the criminal case against the company. 514 

In 2010, as part of an OCC AML examination, an OCC AML examiner reviewed the 
May 2008 memorandum regarding Sigue and asked what followup actions had been taken in 
response to it, in particular whether Sigue had ever been added to the HBUS "wire filter" for 
purposes of enhanced due diligence and whether any further analysis had been done of Sigue 
account activity. 515 HBUS personnel responded that Sigue had not been added to the wire filter, 
the 2008 memorandum had not been "passed to anyone," and the HBUS Financial Intelligence 
Group had not conducted any additional due diligence with respect to Sigue. 516 HBUS explained 
that "Sigue was not added to the wire filter as Sigue entered into a written agreement with the 
Department of Justice to enhance its AML program and was not (per the investigative search) the 
subject of any other money laundering investigations." 517 Essentially, despite Sigue' s deferred 
prosecution in 2008, admission of wrongdoing caused in part by an inadequate AML program, 
past HBMX alerts flagging unusual transactions, past HBUS wire transfer analysis identifying 
suspicious activity, past recommendations by Compliance to close the account, and past 
regulatory inquiries, HBUS did not conduct any enhanced monitoring or analysis of the Sigue 
account. 

HBMX's relationships with Puebla and Sigue, a Mexican casa de cambio and a U.S. 
money service business that remitted funds to Mexico and Latin America, demonstrate its 
tolerance for high risk clients, and how those clients subjected, not only HBMX, but also HBUS 
to substantial money laundering risks. The accounts also disclose how both banks failed to 
conduct effective monitoring of some financial institution accounts and transactions, even when 
faced with evidence of lax AML controls and criminal proceedings involving money laundering. 
They also expose an absence of regular information sharing and coordinated AML efforts 
between HBUS and HBMX to address common AML problems, including limited 
communications about particular clients and actions taken to restrict or close accounts. 

(2) Cayman Island U.S. Dollar Accounts 

A second example of high risk HBMX clients posing money laundering risks to HBUS 
are the tens of thousands of U.S. dollar accounts maintained by HBMX through its branch office 
in the Cayman Islands. This branch office is a shell operation with no physical presence in the 
Caymans, and is managed by HBMX personnel in Mexico City who allow Cayman accounts to 
be opened by any HBMX branch across Mexico. Total assets in the Cayman accounts peaked at 
$2.1 billion in 2008. Internal documents show that the Cayman accounts had operated for years 
with deficient AML and KYC controls and information. An estimated 15% of the accounts had 
no KYC information at all, which meant that HBMX had no idea who was behind them, while 



M4 See United States v. Sigue Corp. and Sigue LLC , Case No. 4:08CR54 (USDC EDMO), Order for Dismissal with 
Prejudice (1/30/2009). 

515 See 2/16-18/2010 exchange of emails among Federal Reserve Patricia Brunner, HBUS Denis O'Brien, Judy 
Stoldt, and others and OCC Joseph Boss, "June 2008 Audit - Payment Services," OCC-PSI-00378989. 

516 Id. 

517 5/1/2008, memorandum [dated 5/1/2007, sic] from HBUS Judy Stoldt and HBUS Gloria Stazza to HBUS Denise 
Reilly, Re: Wall Street Journal Article Regarding Wachovia, OCC-PSI-01358517. 
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other accounts were, in the words of one HBMX compliance officer, misused by "organized 
crime." Because a primary feature of the Cayman accounts is their use of U.S. dollars, HBMX 
has maintained the account assets and conducted account transactions through its U.S. dollar 
correspondent accounts at HBUS. There is no documentation showing that HBUS knew or was 
informed that, by providing HBMX with correspondent accounts, it was also providing access to 
the U.S. financial system to high risk accountholders in the Caymans. By moving the Cayman 
transactions through its HBUS accounts, HBMX exposed not only itself, but also HBUS to the 
money laundering risks inherent in its Cayman clients. 

Cayman Accounts. HSBC acquired the Cayman branch through its purchase of Bital in 
November 2002. According to a letter from HSBC legal counsel: 

"Bital received authorization from Mexican and Cayman authorities to offer Cayman 
USD [U.S. dollar] accounts to its customers in 1980. Bital' s license and authorization to 
offer Cayman USD accounts was inherited by HBMX when HSBC acquired Bital in 
2002." 518 

After the acquisition, the Cayman branch of Bital was renamed HSBC Mexico SA. and 
continued to operate under a Cayman Class B banking license, restricting the branch to operating 
only "offshore" and open accounts exclusively for non-Cayman residents. 51 From its inception, 
the branch had no physical office or employees in the Cayman Islands, and operated in that 
jurisdiction solely as a shell entity. 520 The Cayman accounts were actually opened and 
maintained by HBMX personnel in Mexico. Any HBMX branch across Mexico had the 
authority to open a Cayman account for a client. 521 

To enable the Cayman branch to provide U.S. dollar accounts to clients, HBMX used its 
correspondent accounts at HBUS to supply the needed dollars, process U.S. dollar wire transfers, 
cash U.S. dollar travelers cheques, and perform similar U.S. dollar services. HBMX did not 
open a separate correspondent account for the Cayman branch, but included Cayman account 
transactions within its general correspondent account at HBUS. The documents and other 
evidence reviewed by the Subcommittee contain no indication that, until recently, HBMX ever 
informed HBUS about its Cayman branch or the Cayman U.S. dollar denominated accounts 

522 

being serviced through the HBMX correspondent accounts at HBUS. 



6/5/2012 letter from HSBC legal counsel to the Subcommittee, at 4. 

519 See, e.g., 7/31/2008 email from HSBC David Bagley to HSBC Richard Bennett, "HBMX-CAYMAN 
ACCOUNTS," HSBC OCC 8874827-33. See also list of Cayman offshore banks at http://www.offshore- 
library.com/banking/cayman_islands/page_3. According to HSBC, HBMX policy is not to offer the accounts to 
either Cayman or U.S. residents. See 6/5/2012 letter from HSBC legal counsel to the Subcommittee, at 5. 

520 See, e.g., 7/31/2008 email from HSBC David Bagley to HSBC Richard Bennett, "HBMX-CAYMAN 
ACCOUNTS," HSBC OCC 8874827-33. 

521 See, e.g., 1/2006 "General Audit Report, HBMX - KYC of USD Current Accounts in Grand Cayman," prepared 
by Group Audit Mexico, HSBC OCC 8874307-310, at 1. This audit reviewed files for Cayman accounts that had 
been opened by 26 HBMX branches in Mexico City. Id. 

522 Michael Gallagher, for example, who headed the HBUS PCM division that helped handle correspondent 
accounts, told the Subcommittee he had been unaware of the U.S. dollar Cayman accounts at HBMX. 
Subcommittee interview of Michael Gallagher (6/13/12). 
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The number of accounts and the volume of assets held in the Cayman accounts have 
fluctuated over time. Documentation associated with the 2002 Bital purchase do not indicate 
how many Cayman accounts then existed or the total amount of assets they held. A 2006 audit 
of the Cayman accounts reported just 1,500 accounts in 2005, with no mention of the account 
balances. In September 2008, HBMX reported a remarkable increase, over 60,000 Cayman 
accounts for nearly 50,000 customers, with total assets approaching $2.1 billion. 524 Three years 
later, however, those totals dropped significantly. According to HSBC legal counsel, as of 
January 2012, the Cayman branch held about 24,000 Demand Deposit and Term Deposit 
Accounts for nearly 21,000 customers, with a total dollar value of approximately $657 
million. 525 About 9,000 Cayman accounts had been closed in 2009, due in part to insufficient 
Know-Your-Customer (KYC) information for the accounts as well as regulatory concerns about 
their high risk nature. 

Inherent Riskiness of Accounts. HBMX and HSBC Group were well aware that the 
Cayman accounts had an inherently higher AML risk than other Mexican accounts, since they 
were offered in an offshore jurisdiction with strong secrecy laws and a limited tax regime, and 
permitted accountholders to hold assets in U.S. dollars in contravention of normal Mexican legal 
restrictions. 

In 2008, HSBC Group Compliance head David Bagley noted in an email to senior HSBC 
Group officials that Mexican regulators knew of the Cayman accounts, which apparently 
circumvented certain Mexican banking regulations, but nevertheless allowed them to operate: 

"The [Cayman] license, inherited from Bital, allows HBMX to provide USD- 
denominated services to persons domiciled in Mexico. Mexican regulation apparently 
prohibits individual Mexicans (i.e. non-corporate) to hold USD-denominated deposit 
accounts in Mexico. . . . Although HBMX were recently fined USD50,000, for the 
inappropriate promotion of these services in Mexico, I am advised that CNBV are aware 
of the existence of the accounts and services and have raised no concerns." 

Mr. Bagley also warned: 

"There continues to be a real focus on the level of USD-denominated activity in Mexico 
by CNBV and other bodies, and the extent of HBMX's activity in this area. This account 
base has to therefore be seen as high-risk from an AML and reputational perspective." 



See 1/2006 "General Audit Report, HBMX - KYC of USD Current Accounts in Grand Cayman," prepared by 
Group Audit Mexico, HSBC OCC 8874307-310, at 1. 

524 See chart at HSBC OCC 8876787, attached to 9/12/2008 email from HSBC John Root to HSBC Adrian Cristiani, 
"Cayman Accounts," HSBC OCC 8876784. 

525 See 6/5/2012 letter from HSBC legal counsel to the Subcommittee at 5. 

526 7/31/2008 email from HSBC David Bagley to HSBC Richard Bennett, with copies to HSBC Michael 
Geoghegan, Matthew King, and HBMX Emilson Alonso, Luis Pena, and John Rendall, "HBMX-CAYMAN 
ACCOUNTS," at HSBC- OCC-8874832. 
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In November 2005, an email from HBMX Compliance head Ramon Garcia to senior 
HSBC Group Compliance officer John Root flagging compliance issues at HBMX provided this 
explanation for the Cayman accounts: 

"There is a Cayman Island branch for HBMX. Since there is a restriction by Mexican 
Law to open accounts to nationals in USD except for those residing in the Mexico's 
border, as an alternative, [Bital] decided to open this branch where cheques accounts to 
Nationals could be opened in USD. It is also known that these USD accounts were 
issued also to non Mexican Nationals." 528 

A January 2006 HBMX internal audit report explained the demand for the accounts this 
way: "HBMX offers their clients the option to open USD current and investment accounts in 
Grand Cayman so that clients profit [from] the advantages of that country, such as tax free 
investments, under confidentiality terms." 529 In a 2007 email discussing the sale of cross-border 
financial products in Mexico, HSBC Group Compliance Deputy Head Warren Learning also 
noted: "Because Mexico's tax scheme is relatively penal (worldwide income) there is a high 

con 

demand for off-shore products." 

Below Standard AML and KYC Controls. The riskiness of the Cayman accounts was 
magnified by weak AML controls and inadequate KYC information. Those AML deficiencies 
meant that HBMX had little real knowledge about the customers using the Cayman accounts. 

HSBC Group knew about the weak state of the Cayman AML and KYC controls from 
the time Bital was purchased in 2002, and it inherited the Cayman branch. An audit prior to the 
acquisition found that Bital had no functioning Compliance Department, limited client 
transaction and activity monitoring, and no KYC focus on high risk clients. 531 The audit 
specifically noted the poor state of KYC information in the Cayman accounts: "41% of the 
accounts reviewed (92 of 224 reviewed) lacked full client information. 37 files had no client 

coo 

information." 

In 2004, Mexico strengthened KYC requirements for Mexican financial accounts and 
required Mexican banks to update the KYC information in all customer accounts by 2007. In 
January 2006, HBMX's audit group conducted an audit of the KYC controls in place for the 
Cayman accounts and rated them "Below Standard." 533 Of the Cayman accounts reviewed, the 
audit found that 13% of the files lacked material KYC information; more than 50% lacked a visit 



528 1 1/22/2005 email from HBMX Ramon Garcia to HSBC John Root, "HBMX - COMPLIANCE ISSUES," HSBC 
OCC 8873261. 

529 1/2006 "General Audit Report, HBMX - KYC of USD Current Accounts in Grand Cayman," prepared by Group 
Audit Mexico, HSBC OCC 8874307-310, at 1. 

530 5/24/2007 email from HSBC Warren Learning to HSBC David Bagley, "He advises that his own compliance 
team are advising him that such cross border activities should cease. -HBMX," HSBC OCC 8875007. 

531 July 2002 "Group Internal Audit: Due Diligence Review - Project High Noon," prepared by HSBC internal 
audit group, HSBC OCC 8873846-852. 

532 Id. at HSBC OCC 8873847. 

533 1/2006 "General Audit Report, HBMX - KYC of USD Current Accounts in Grand Cayman," prepared by Group 
Audit Mexico, HSBC OCC 8874307, at 1 (emphasis in original). 
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report with the client; some foreign clients were incorrectly described as Mexican nationals; and 
15% of the account files were missing altogether: 

"More than 50% of account files that were reviewed lacked the relevant visit report, 
which weakens the position of HBMX in terms of KYC process for these types of 
accounts (Grand Cayman), particularly those accounts opened by foreigners. In addition, 
in 13% of files reviewed the visit reports failed to include material information enabling 
to have adequate KYC. 

Weaknesses were noted in the supervision over the account opening process, which also 
impeded to detect promptly any information missing in account files or inconsistencies 
between the information produced by the client and the data captured in Cis-Hogan 
[[HBMX data system]. ... In addition, the auditors indentified foreign clients who were 
input to the system as nationals. 

In addition to the foregoing, c[irca] 15% (10) of account files were not found at the 
Branches. No actions had appeared to be taken to instruct RMs [Relationship Managers] 
to complete client's file again. 

In particular the auditors indentified that for accounts opened by foreign clients these had 
produced expired immigration forms and that Branch staff did not maintain a copy of all 
the pages composing such a document. This situation was due, in part, to the fact that 
circular letter Depvist045 (procedure to open current and term accounts) is not clear in 
the procedure to open these types of accounts (Grand Cayman)." 534 

The audit concluded with the recommendation: "Branch should ensure that KYC and account 
opening documentation is complete and in compliance with regulations." 535 

The 2006 audit uncovered severe AML and KYC deficiencies in the Cayman branch 
requiring remedial action to comply with the Mexican deadline for improving customer file KYC 
information, but those audit results appear to have been ignored. The audit recommendations 
were recorded in HBMX's electronic system, but later closed out without any apparent actions 
having been taken in response, which does not comport with Group policy. 536 Two years later, 
in 2008, John Root, senior HSBC Group Compliance officer, rediscovered the 2006 audit when 
examining KYC problems in the Cayman accounts. He wrote: "The real surprise was the 
existence of an HBMX audit in January 2006 on KYC for the USD Cayman accounts. It is not 
clear who in AML responded, and how. Blank looks all around." 537 His supervisor, Mr. Bagley, 
later jokingly remarked to the Head of Group Audit for Latin America and the Caribbean, 



iib See 7/30/2008 email from HSBC John Root to HSBC David Bagley, "HBMX Visit Update," HSBC OCC 
8876780-782; 8/5/2008 email exchange among HSBC David Bagley, HSBC John Root and HBMX Graham 
Thomson, "HBMX - Cayman accounts," HSBC OCC 8874829-830. 

537 7/30/2008 email from HSBC John Root to HSBC David Bagley, "HBMX Visit Update," HSBC OCC 8876780- 
782. 
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Graham Thomson: "I do find it surprising that there can have been no response and yet the audit 
was closed out. Is this a breach or are you in audit becoming softer." 538 

Project Restoration. As the 2007 deadline approached for completing the KYC updates 
mandated by Mexican law and internal reports showed that HBMX's KYC documentation 
remained in poor condition, HBMX obtained a year-long extension from Mexican regulators, to 
May 2008, to clean up its files, including client files for the Cayman accounts. 539 

In February 2008, Mexican regulators met with the HBMX CEO and, among other 
issues, criticized the bank's poor KYC documentation, leading HBMX to initiate "Project 
Restoration" to intensify its KYC remediation efforts. 540 John Rendall, HBMX Chief Operating 
Officer, was put in charge of the project with the understanding that files containing inadequate 
KYC would be closed. 541 Project Restoration was closely monitored by senior HBMX and 
HSBC Group officials. 

At first, the Cayman accounts were excluded from the project. Then, in July 2008, 
HBMX's monitoring system suddenly began generating alerts for a number of Cayman accounts. 
These alerts, which highlighted suspicious account activity, were brought to the attention of 
senior Compliance personnel. The head of HSBC Group Compliance David Bagley told the 
Subcommittee this incident was the "first point that the Cayman Islands were brought into sharp 
focus" for him. He sent an email informing senior HSBC Group and HBMX officials about 
the alerts which had identified "significant USD [U.S. dollar] remittances being made by a 
number of [HBMX Cayman] customers to a US company alleged to be involved in the supply of 
aircraft to drug cartels." 543 The company was Cabello Air Freight Inc. of Miami. 544 Mr. Bagley 
wrote that "[a]s a precaution HBMX have issued instructions that no new [Cayman] accounts be 
opened pending a review of these activities." 545 This step was taken with respect to the Cayman 
accounts, in the words of one HBMX compliance officer, "due to the massive misuse of them by 
organized crime." 546 



538 8/5/2008 email from HSBC David Bagley to HBMX Graham Thomson, "HBMX Cayman accounts," at HSBC 
OCC 8874829. 

539 See 7/27/2007 minutes of HSBC LAM Regional Audit Committee, HSBC OCC 8875086-090 (noting extension 
of time for the KYC effort until May 2008). 

540 See 6/5/2012 letter from HSBC legal counsel to the Subcommittee^ 2. 

541 See, e.g., 10/28/2008 email from Graham Thomson to Emilson Alonso, Subject: "HBMX - Projecto 
Restauracion," HSBC OCC 8873464. 

542 Subcommittee interview of David Bagley (5/10/2012). 

543 7/31/2008 email from HSBC David Bagley to HSBC Richard Bennett, with copies to HSBC Michael 
Geoghegan, Matthew King, and HBMX Emilson Alonso, Luis Pena, and John Rendall, "HBMX-CAYMAN 
ACCOUNTS," HSBC OCC 8874832-33. 

544 See also Sealed Exhibits. 

545 7/31/2008 email from HSBC David Bagley to HSBC Richard Bennett, with copies to HSBC Michael 
Geoghegan, Matthew King, and HBMX Emilson Alonso, Luis Pena, and John Rendall, "HBMX-CAYMAN 
ACCOUNTS," HSBC OCC 8874832-33. 

546 1 1/27/2008 email from HBMX employee to HBMX Jaime Saenz and Ramon Garcia, "Seriously consider 
restricting the product Dollars accounts in the zona frontera Product 63," HSBC OCC 8875736-738. 
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The decision to suspend new Cayman accounts was made by then HBMX CEO Luis 
Pena who did not specify when the suspension would be lifted. 547 He also instructed HBMX 
staff to engage in "a process of enhanced due diligence KYC" for all Cayman accountholders to 
"end by December 1." He wrote: 

"After this date we will cancel all the accounts that we were not able to complete files on 
and will send cashiers checks to all the respective customers. For the future, Mexicans 
who wish to open a dollar denominated account will undergo a referencing process, in 
which the accounts will be . . . opened by the bank's staff in a proper offshore book as we 
do in our Premier offering. . . . Unfortunately we will likely lose some deposits as we do 
not expect the KYC process to succeed 100%, but we will offset a significant control and 
regulatory risk." 548 

Also in July 2008, after reviewing the 2006 audit of the Cayman accounts, Mr. Root 
informed Mr. Bagley that "a sampling showed thatl5% of the customers did not even have a 
file." 549 Mr. Root wrote: "Fixing the Cayman accounts will be a struggle. How do you locate 
clients when there is no file?" Missing client files, combined with accounts misused by drug 
cartel operatives, provided stark evidence of the high risk character of the Cayman accounts and 
the need to for HBMX to get a better sense of the clients using them. In the meantime, the 
documents contain no indication that either HSBC Group or HBMX informed HBUS about the 
suspect account activity or the Cayman KYC deficiencies, even though the Cayman accounts 
were operating solely through the HBMX correspondent account at HBUS. 550 

As a result of the AML alerts regarding money laundering involving some of the Cayman 
accounts and re-discovery of the 2006 audit exposing the poor state of the Cayman account files, 
the Cayman accounts were added to the Restoration Project. 551 Mr. Root told the Subcommittee 
that, in July 2008, the Cayman accounts "went to the top of the list" at the project. 

One of the first steps taken with regard to the Cayman accounts was that HBMX 
Compliance personnel analyzed their risk levels, and sorted customers into three categories: red, 
yellow, and white. Red status indicated that a customer was a "Special Category Client" (SCC), 
on a "black list," or the subject of a SAR; yellow status indicated that a customer had been 



See 7/31/2008 email from HBMX Luis Pena to HBMX Emilson Alonso, HSBC David Bagley and others, 
"HBMX - CAYMAN ACCOUNTS," HSBC OCC 8873503-504. See also undated HSBC presentation, 
"Conducting an Enhanced KYC for Grand Cayman Accountholders: Proposal to Update the Strategy to Control 
Risk arising from Grand Cayman Accounts," HSBC OCC 8874561. 

548 7/31/2008 email from HBMX Luis Pena to HBMX Emilson Alonso, HSBC David Bagley and others, "HBMX - 
CAYMAN ACCOUNTS," HSBC OCC 8873503-504. 

549 7/31/2008 email from HSBC John Root to HSBC David Bagley, "HBMX Visit Update," HSBC OCC 8876780- 
782. 

550 Another example of a Cayman U.S. dollar account that HSBC Group and HBMX were aware of and expressed 
concerns about, but apparently did not inform HBUS, were accounts opened for two embassies, one of which was 
for a country in the Middle East. See 12/2/2005 email exchange between HSBC David Bagley and John Root, 
"OFAC," HSBC OCC 8876612-613. Mr. Bagley told the Subcommittee that although there was no indication of 
any "sinister" activity, these accounts were later closed, because the bank "did not want the risk." Subcommittee 
interview of David Bagley (5/10/12). 

551 Subcommittee interview of David Bagley (5/10/12). 

552 Subcommittee interview of John Root (4/26/12). 
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flagged by HBMX's internal AML monitoring system with one or more alerts, but no SAR had 
been filed; white status indicated that the customer had no such derogatory information on 
file. 553 Out of a total of 49,935 customers with 61,586 accounts worth about $2.1 billion, 
HBMX categorized 1,314 customers as "red" status, representing 2,240 accounts worth about 
$205 million. HBMX also flagged 2,027 customers as "yellow" status, representing 2,084 
accounts worth about $180 million. 554 HBMX then largely limited its KYC remediation efforts 
to the 3,341 "red" and "yellow" customers. The other 46,000 accountholders were not included 
in the project. 555 

Two months later, in September 2008, senior HSBC Group Compliance officer John 
Root offered a negative assessment of the KYC remediation efforts directed at the Cayman 
accounts: 

"The HBMX 'Restoration' project chaired by John Rendall, HBMX COO, is endeavoring 
to regularize these accounts on a risk-basis. Account opening documentation is generally 
poor or non-existent and there is a lot of work to do. Money-laundering risk is 
consequently high." 556 

An HSBC presentation, which is undated but appears to have been prepared in October 
2008, summarized the ongoing Cayman KYC problems and presented a new strategy to address 
them. The presentation was entitled, "Conducting an Enhanced KYC for Grand Cayman 
Accountholders: Proposal to Update the Strategy to Control Risk arising from Grand Cayman 

558 

Accounts." One key slide noted that "almost no progress [had] been made in enhanced KYC 
completion" and that only 25% of the files would have complete KYC information by December 
1,2008: 

"• The Bank has been recently been fined for offering this product in Mexico, and money 
laundering red flags have been identified. 

• On 28JUL, CMP [Compliance] gave instructions to suspend this product. 

• On 31JUL08, Segment Directors were requested by CEO that an enhanced KYC will be 
completed for all Grand Cayman accounts before 01DEC08. 



See 9/12/2008 email from HBMX Ramon Garcia to HSBC John Root, "Cayman Accounts," HSBC OCC 
8876784. 

554 See Attachment to 9/12/2008 email from HBMX Ramon Garcia to HSBC John Root, "Cayman Accounts," 
HSBC OCC 8875462 at 465. 

555 See undated HSBC presentation, "Conducting an Enhanced KYC for Grand Cayman Accountholders: Proposal 
to Update the Strategy to Control Risk arising from Grand Cayman Accounts," HSBC OCC 8874560-566, at 561 
("It is considered that it will not be possible to complete 50,000 enhanced KYC by 01DEC08."). 

556 9/12/2008 email from HSBC John Root to Adrian Cristiani and others, "Cayman Accounts," HSBC OCC 
8875462-465, at 462. 

557 Undated HSBC presentation, "Conducting an Enhanced KYC for Grand Cayman Accountholders: Proposal to 
Update the Strategy to Control Risk arising from Grand Cayman Accounts," Bates Nos. HSBC OCC 8874560 - 
566. Because of dates mentioned in the presentation, it seems to have been completed between September 27 and 
October 30, 2008. 

558 Undated HSBC presentation, "Conducting an Enhanced KYC for Grand Cayman Accountholders: Proposal to 
Update the Strategy to Control Risk arising from Grand Cayman Accounts," Bates No. HSBC OCC 8874560 
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• As of JUL08, in Grand Cayman CDA/DDA 49,937 customers, and its portfolio was 
approximately USD 1,500 million. 559 

• Currently, this product is expected to be re-opened, as long as necessary adjustments to 
systems, processes and documentation are made, with stricter controls, and if Group 
Compliance's sign-off is obtained. 

• On 26SEP, Segment directors reported that almost no progress has been made in 
enhanced KYC completion. In addition, a central validation of enhanced KYC quality is 
not in place. 

• According to Remediation Project results, success rate in file completion is 
approximately 25%. This means that if this strategy is followed, it will not be possible to 
complete more that 25% of required enhanced KYC forms by 01DEC08." 560 

This October 2008 assessment indicates that at least 75% of the Cayman files still had 
incomplete KYC information six years after HBMX assumed control of the accounts. 

Despite this grim assessment, the Strategy also noted efforts underway to allow new 
Cayman accounts to be opened. 561 As Graham Thomson, head of Group Audit for Latin 
America and the Caribbean, explained in an email to colleagues, the accounts needed to continue 
due to the income they produced: 

"Currently the business owner and compliance are still discussing with GMO CMP 
[Compliance] the product parameters that are to be applied to lift the current embargo and 
relaunch the CI [Cayman Island] product. It is important that these discussions result in 
practical product parameters as the CI portfolio is an important source of funds for 
HBMX and it is hoped the replacement product will be shortly submitted to the new 
products committee and then relaunched." 562 

Internal documents show that HSBC Group and HBMX officials considered a variety of criteria 
to determine when a new Cayman account could be opened, including requirements that the 
client be an existing HBMX customer for six months, complete an "enhanced KYC 
Questionnaire," undergo screening against the OFAC list and other "blacklists," and agree to 
limits on cash deposits. 563 

U.S. Dollar Restriction. In November 2008, HSBC Group CEO Michael Geoghegan 
traveled to Mexico and met with senior Mexican regulators who were highly critical of HBMX's 
AML and KYC efforts, the huge volume of U.S. dollars that HBMX was exporting to the United 
States, and the possibility that a portion of those funds were associated with drug trafficking and 



The figure of $1,500 million seems to refer to the Cayman certificates of deposit and does not include additional 
funds in Cayman Demand Deposit Accounts. 

560 Undated HSBC presentation, "Conducting an Enhanced KYC for Grand Cayman Accountholders: Proposal to 
Update the Strategy to Control Risk arising from Grand Cayman Accounts," HSBC OCC 8874560, at 561. 

561 Id. at 561. 

562 10/20/2008 email from Graham Thomson to HSBC Emilson Alonso and others, "HBMX - Projecto 
Restauracion," HSBC OCC 887459-600 at 596-597. 

563 See Sept.-Oct. 2008 email exchanges among HBMX Ramon Garcia, John Rendall, Maria Salazar and HSBC 
David Bagley, Warren Learning, Susan Wright, John Root, Adrian Cristiani, HSBC OCC 8875818-829, at 829. 
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money laundering. The regulators explicitly mentioned the U.S. dollars sent from the Cayman 
accounts. 565 In response, Mr. Geoghegan proposed prohibiting all HMBX branches, including 
the Cayman branch, from offering U.S. dollars to customers, except at automated teller machines 
in Mexican airports. 566 Since the Cayman accounts relied on U.S. dollars, the proposed new 
policy directly impacted Cayman accountholders. HBMX CEO Luis Pena nevertheless agreed 
with the proposal, and also ordered the freeze on opening new Cayman accounts to continue 
indefinitely and prohibiting new cash deposits for existing Cayman accounts. 567 Mr. Pena noted 
that the new measures would cost HBMX a lot of money: "Cayman and Mexico dollar accounts 
provide us with US$2.6 billion of cheap funding. We are likely to lose a big portion of this if we 
tell customers we no longer receive dollar notes." 568 The new policies took effect in January 
2009. 

9,000 Accounts Closed. According to HSBC's legal counsel, HBMX took nearly 
another year to complete KYC remediation of the Cayman accounts, finally completing the work 
in July 2009. 569 As part of that KYC effort, HBMX closed approximately 9,000 Cayman 
accounts, due in many cases to incomplete KYC information. 70 At the same time, HBMX 
allowed the Cayman branch to remain in operation and lifted the ban on new accounts. Today, 
over 20,000 HBMX clients have over $657 million in Cayman U.S. dollar denominated 
accounts. 

Because the HBMX Cayman branch continues to offer U.S. dollar accounts, despite a 
history of poor KYC controls and deficient KYC documentation, and despite the inherent 
riskiness associated with operating offshore accounts in a secrecy tax haven, the Cayman 
accounts continue to pose ongoing money laundering risks to HBUS. Because HBUS is now 
aware of the Cayman accounts, it will have to evaluate the risk and determine whether to 
continue to process Cayman account transactions through the HBMX correspondent account. 

(3) Cashing U.S. Dollar Travelers Cheques 

A third example of how HBMX has introduced risk into HBUS involves its issuing and 
cashing millions of dollars in U.S. dollar travelers cheques through its correspondent accounts at 
HBUS, at times under suspicious circumstances. 

Travelers cheques are paper monetary instruments which, for a fee, are issued and 
administered by a financial institution. They can be issued in a variety of currencies and 



See 2/18/2008 email from HBMX Paul Thurston to HSBC Michael Geoghegan, with copies to Richard Bennett 
and Matthew King, "Confidential - CMBV/FIU Meeting," HSBC OCC 8873331-333; 2/18/2008 draft report 
entitled, "Internal Control, HBC Mexico, S.A.," prepared by CNBV, HSBC OCC 8966021-026. 

565 See, e.g., 1 1/26/2008 email from HSBC David Bagley to HSBC Richard Bennett and Warren Learning, 
"Mexico," HSBC OCC 8875605-607, at 607. 

566 See 1 1/26/2008 email from HSBC Michael Geoghegan to HBMX Emilson Alonso, "Money Launderying," 
HSBC OCC 8874849-850. 

567 See 1 1/27/2008 email from HSBC Warren Learning to HSBC David Bagley and Richard Bennett, "Mexico," 
HSBC OCC 8875605-607, at 606. 

568 1 1/28/2008 from HBMX Luis Pena to HSBC Emilson Alonso, HSBC OCC 8874856. 

569 6/5/2012 letter from HSBC legal counsel to the Subcommittee, at 5. 
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denominations, and carry serial numbers so that, if the cheques are lost or stolen, the issuing 
financial institution can trace back the purchase and either replace the cheques or refund the 
money used to purchase them. Individuals often use travelers cheques to minimize carrying hard 
currency while traveling and as a way to safeguard their funds. Some financial institutions issue 
such cheques only to pre-existing customers; others issue the cheques to anyone who pays the 
fee. U.S. financial regulators have long warned financial institutions about the money laundering 
risks associated with travelers cheques, especially when purchased with cash by a non-customer 
and used to move substantial funds across international borders in ways that are difficult to 
trace. Travelers cheques have been used by terrorists, drug traffickers, and other 
criminals. 574 

HBMX has issued a large number of U.S. dollar travelers cheques, at times selling them 
to anyone willing to pay the fee and cashing them for customers and non-customers alike. In 
2004, John Root, senior HSBC Group Compliance officer, sent an email to HBMX's 
Compliance head, Ramon Garcia, and AML head, Carlos Rochin, noting the huge volume of 
travelers cheques pouring in from Mexico and seeking assurances that HBMX was on guard 
against money laundering: 

"I note that in the year through 3Q04 [third quarter of 2004], HBMX has sold over USD 
1 10 million of travelers cheques, an amount that eclipses that of HBEU [HSBC Europe] 
here in the UK, and that is several orders of magnitude higher than any other non-UK 
entity, including Hong Kong and the US. In fact, it represents one-third of the Group's 
total global traveller's cheque business (with the UK representing another third). 

Could you kindly prepare a report for GHQ [Group Headquarters] summarizing the 
money laundering procedures currently in place for such a booming business. Please 



See, e.g., Federal Financial Institutions Examination Council (FFIEC) Bank Secrecy Act/ Anti-Money Laundering 
(BSA/AML) Examination Manual, "Core Overview: Purchase and Sale of Monetary Instruments," (6/23/2005) at 
59; FFIEC BSA/AML Examination Manual, "Purchase and Sale of Monetary Instruments-Overview," (8/24/2007) 
at 212 ("The purchase or exchange of monetary instruments at the placement and layering stages of money 
laundering can conceal the source of illicit proceeds. As a result, banks have been major targets in laundering 
operations because they provide and process monetary instruments through deposits."). 

572 See, e.g., United States v. al-Haramain Islamic Foundation Inc. , Case No. 6:05-cr-60008-HO (USDC Oregon) 
Indictment (2/17/2005); "Former U.S. Head of Al-Haramain Islamic Foundation Sentenced to 33 Months in Federal 
Prison," U.S. Attorney's Office for the District of Oregon press release (9/27/1 1) at 1 (describing how the convicted 
defendant cashed $130,000 in U.S. dollar travelers cheques at a bank in Saudi Arabia and then provided the funds to 
support violent extremists in Chechnya). 

573 See, e.g., United States v. Wachovia Bank N.A. , Case No. 10-20165-CR-Lenard (USDC SDFL), Factual 
Statement, Exhibit A to Deferred Prosecution Agreement (3/16/2010), at f 35 (describing how Wachovia Bank 
processed $20 billion in suspicious travelers cheques, some portion of which was suspected to include illegal drug 
proceeds); "How a Big U.S. Bank Laundered Billions from Mexico's Murderous Drug Gangs," The Guardian , 
(4/2/2011), http://www.guardian.co.uk/world/2011/apr/03/us-bank-mexico-drug-gangs. See also Albajon v. 
Gugliotta , 72 F. Supp. 2d 1362, 1365 (S.D. Fla. 1999) (admitting travelers cheques as evidence of drug trafficking 
proceeds); United States v. $41,305.00 in Currency & Travelers Checks , 802 F.2d 1339, 1343 (11th Cir. 1986) 
(finding travelers cheques could be seized as drug trafficking proceeds). 

574 See, e.g., Folk v. State , 192 So. 2d 44, 46 (Fla. Dist. Ct. App. 1966) (upholding conviction for signing a false 
name on travelers cheques and cashing them); United States v. Sebaggala , 256 F.3d 59, 63 (1st Cir. 2001) 
(upholding conviction for using undeclared travelers cheques to attempt to move money fraudulently through U.S. 
customs). 
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include in this report KYC controls, number of SARs in the YTD [year to date], 
breakdown by region and branch, etc., etc." 575 

Mr. Garcia responded with preliminary information and a recent case involving travelers 
cheques, but in response to Mexican legal requirements regarding client- specific information, 
HSBC has so heavily redacted copies of those documents, as well as a longer report requested by 
Mr. Root, that they do not provide additional information. 576 

In 2008, when HBMX decided to stop offering U.S. dollars at its branches in most cases, 
the HBMX CEO Luis Pena recommended greater use of U.S. dollar travelers cheques instead, 

577 

sold only to pre-existing customers. In response, the Deputy Head of HSBC Group 
Compliance, Warren Learning, warned that travelers cheques also raise AML concerns, and 
advised lowering the existing $25,000 ceiling on the amount of travelers cheques that could be 
purchased by one customer at a time, and creating a new limit on the amount of travelers cheques 

578 

that could be deposited at one time to a client account. 

In 2009, after CNBV expressed concerns about HBMX's weak AML controls, among 
other steps, HBMX tightened its policies on travelers cheques. As of January 1, 2009, HBMX 
determined that it would sell its travelers cheques only to pre-existing customers and would place 

57Q 

a limit on the amount that could be sold to any one customer at a time. Warren Learning, 
Deputy Head of HSBC Group Compliance, who supported those changes, noted in an email: 
"There remain AML issues in respect of travellers cheques which historically are very high risk 
from an AML perspective and accordingly we would expect that the limits are reasonably low 
and that there are very strong controls in place to ensure that branches do not abuse the rules." 580 

At HBUS, the documents reviewed by the Subcommittee indicate that, despite their large 
volume, HBMX travelers cheques attracted little AML review or attention, even though the 
travelers cheques would have been presented for payment at HBUS' processing centers in New 
York and subjected to review. The HBUS processing centers segregated and reviewed all 
travelers cheques and were required to send blocks of sequentially numbered cheques exceeding 
$10,000 to HBUS AML Compliance for review. 581 At the same time, the processing centers had 
no information on expected account volume, conducted no trend analysis to identify suspicious 



1 1/8/2004 email from HSBC John Root to HBMX Ramon Garcia and Carlos Rochin, with copies to HSBC 
David Bagley and Susan Wright, "Travellers Cheques," HSBC OCC 8876645-646. 

576 See 1 1/30/2004 email from HBMX Ramon Garcia to HSBC John Root, David Bagley, Susan Wright, and 
HBMX Carlos Rochin, "Travellers Cheques," HSBC OCC 8876645-664. 

577 See 1 1/27/2008 email from HBMX Luis Pena to HBMX Emilson Alonso, copy to HSBC Michael Geoghegan, 
"Money Launderying," HSBC OCC 8874849. 

578 See 12/8/2008 email from HSBC Warren Learning to HBMX Ramon Garcia and John Rendall with copies to 
HSBC David Bagley, John Root, Susan Wright, and others, "Mexico Visit," HSBC-PSI-PROD-0197874-876. 

579 12/8/2008 email from HSBC Warren Learning to HBMX Ramon Garcia and John Rendall, with copies to HSBC 
David Bagley, Susan Wright, John Root, and others, "Mexico Visit," HSBC-PSI-PROD-0197874-876. 

580 Id. 

581 See 6/26/2008 OCC memorandum, "Pouch Transactions - Hokuriku Bank and SK Trading Company Ltd," 
OCC-PSI-00885828, at 1 [Sealed Exhibit.]. HBUS' AML policies and procedures regarding travelers cheques are 
discussed in more detail in the Report Section on Hokuriku Bank: Cashing Bulk Travelers Cheques, supra . 
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transactions, and conducted no due diligence on the persons cashing the cheques. A 2007 
OCC examination of HBUS' pouch activities, which included clearing U.S. dollar travelers 
cheques, identified numerous deficiencies in the AML policies and procedures and called for 
stronger AML controls, but it did not appear to result in any greater review of the HBMX 
travelers cheques. To the contrary, a 2007 HBUS policy change appears to have further 
limited AML reviews of travelers cheques presented by HSBC Group affiliates in non-high risk 
countries, restricting them to cases where the deposits exceeded $1 million. 584 At that time, 
HBUS deemed both Mexico and HBMX to be at low risk of money laundering. 

In 2009, the OCC conducted a second review of HBUS' pouch activities, including 

585 

procedures to clear U.S. dollar travelers cheques. As part of that examination, HBUS 
produced to the OCC a lengthy description of its AML policies and procedures for foreign 
financial institutions that present items for processing through a correspondent account, 
including travelers cheques. 586 Those procedures contained a number of restrictions or 
conditions, but did not impose a ceiling on the amount of money that HBUS would provide to a 
correspondent client through the cash letter process. The procedures did, however, require 
transactions over a certain amount to be reported to HBUS AML Compliance before processing. 
The reporting triggers were linked to the risk rating of the foreign financial institution presenting 
the monetary instrument for payment. The five relevant risk ratings, from highest risk to lowest, 
were: Special Category Client (SCC), high risk, cautionary risk, medium risk, and standard risk. 
The reporting triggers were as follows: 

For SCC customers - $1,000 for an individual item, and $10,000 in total deposits. 
For high risk customers - $10,000 for an individual item, and $100,000 in total. 
For cautionary risk customers - $50,000 for an individual item, and $200,000 in total. 
For standard and medium risk customers - $50,000 for an individual item and $250,000 
in total. 

Clients seeking to cash travelers cheques in excess of the reporting threshholds were not 
automatically prohibited from proceeding; instead, their transactions were reported to HBUS 
AML Compliance which was then supposed to make a case-by-case decision on whether to 
allow the transactions to proceed. 



i82 See 4/27/2007 email from HBUS Robert Guthmuller to HBUS Alan Ketley, "Visit to Brooklyn OpsLink," OCC- 
PSI-00312153, at 4. 

583 See 3/31/2007 OCC Report of Examination, OCC-PSI-00304077 [Sealed Exhibit]; 9/13/2007 OCC Supervisory 
Letter, "Pouch Services and Middle Market at HBUS," OCC-PSI-0000039 1-394. [Sealed Exhibit.] 

584 See 5/7/2007 email from HUBS George Tsugranes to HBUS Alan Ketley and others, "Visit to Brooklyn Ops," 
OCC-PSI-003 12153, at 3. 

585 See, e.g., 2/15/2010 email from HBUS Jane Burak to HBUS Lesley Midzain, "Advice Requested," OCC-PSI- 
00256833 (describing banknotes examination that included reviews of travelers cheques); 2/1 1/2010 minutes of a 
"OCC & Chicago FED update Meeting," prepared by HSBC, OCC-PSI-00256916 (noting that HSBC made a 
presentation to the OCC on 2/9/2010, on enhancements to its cash letter process and an "internal look-back of cash 
letter activity for Travelers Checks and Money Orders"). 

586 See undated "Request No. 7," prepared by HSBC, OCC-PSI-00000123-130 (providing detailed information in 
response to OCC questions regarding HBUS' remote deposit capture and cash letter pouch transactions). [Sealed 
Exhibit.] 
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By 2009, Mexico and HBMX were considered high risk and, due to the large volume of 
HBMX travelers cheques it sold, HBMX cheques should have regularly triggered the AML 
reporting requirement and AML reviews. In addition, HBMX travelers cheques should have 
produced numerous alerts due to the large amounts, sequentially numbered cheques, and 
structuring patterns involved. Instead, the documentation suggests that few alerts issued and 
very little review of HBMX travelers cheques took place. 

As part of its 2009 examination, the OCC expressed concern that, based on samples taken 
from 2007, 2008, and 2009, HBUS' monitoring of travelers cheques required too few AML 

COT 

reviews and was inadequate to detect suspicious activity. In response, HBUS undertook a 

588 

detailed review of all cash letter items in 2009. HBUS determined that 280 items had been 
flagged for review, a tiny number in comparison to the huge number of transactions cleared per 
year. In addition, according to HBUS, of those 280 items, less than a handful contained 
information suggesting suspicious activity. While HBUS presented that result as evidence of 
minimal AML risk, it is possible that the criteria used to flag transactions for review were too 
narrow to catch suspicious transactions. 

One reason to think the latter might be the case is that, from 2007 to 2012, other financial 
institutions have reported significant instances of suspicious activities involving U.S. dollar 
travelers cheques either issued or cleared by HBMX. 590 These reports generally describe 
coordinated teams of individuals, each of whom purchased large numbers of travelers cheques 
from HBMX, and then cashed or deposited the cheques in suspicious patterns. Some of the U.S. 
dollar travelers cheques identified by these financial institutions had a combined value in excess 
of $1 million, and some of the suspicious activity occurred over an extended period of time. 
Many of the suspicious transactions involved sequentially numbered cheques, illegible 
signatures, or difficult to understand markings or numbers on the cheques. In some cases, groups 
of cheques were made payable to the same health food business, toy company, or automobile 
auction house. 

Four examples illustrate the issues. In the first example, nearly 1,500 U.S. dollar 
travelers cheques were purchased from the same HBMX branch in Mexico over a seven-month 
period from 2007 to 2008, and cashed shortly thereafter at several automobile auctions in the 
United States. Money launderers have been shown in the past to utilize the purchase of 
expensive, but liquid items, such as cars to hide illicit funds. The travelers cheques had a 
combined value of $900,000. In a second instance from 2008, on four occasions over a period of 
16 days, individuals purchased from an HBMX branch in Mexico travelers cheques which, each 
time, had a combined value of $20,000 to $30,000, and altogether added up to $109,000. All of 
the cheques were then signed and countersigned with the same illegible signature, and made 
payable to the same toy business in Mexico. Ten months later, in a coordinated effort over a 
two- week period, all of the cheques were either cashed or deposited. In a third instance, 188 
travelers cheques in denominations of $500 and $1000, totaling $110,000, were purchased in 



587 See 2/15/2010 email from HBUS Janet Burak to HBUS Lesley Midzain, "Advice Requested," OCC-PSI- 
00256833. 

588 Id. 

589 Id. 

590 See Sealed Exhibits. 
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nine large blocks of sequentially numbered cheques from a major U.S. bank. Then, over a three- 
month period from April to June 201 1, all 188 cheques were negotiated for payment at the same 
HBMX branch in Mexico, using illegible signatures so that the cheques provided no information 
about the payees. 

In the fourth instance, two men purchased groups of travelers cheques from the same 
HBMX branch in Mexico. On 14 occasions over a three month period in 201 1, the two men 
purchased the travelers cheques in batches which, each time, had a combined value of $10,000, 
and altogether added up to $140,000. All of the cheques were then signed with the same 
illegible signature. Over time, small groups of the travelers cheques, often with consecutive 
serial numbers, were cashed or deposited, with the majority of cheques failing to bear a stamp 
indicating exactly where they were negotiated. The 201 1 transactions were part of a larger 
pattern in which the same HBMX branch sold travelers cheques to the same two men over a 
three year period from 2009 to 201 1, for a combined value of $1.9 million. 

While HBMX has tightened its travelers cheque policies by restricting the sale of 
travelers cheques to pre-existing customers and limiting the dollar amount of travelers cheques 
that can be provided to one customer at a time, HBMX travelers cheques continue to surface in 
reports of suspicious activities filed with U.S. authorities. Because many if not all of the cheques 
are cashed through the HBMX correspondent accounts at HBUS, HBMX continues to expose 
HBUS to money laundering risks through its issuance and cashing of U.S. dollar travelers 
cheques. 

HBMX's money service business clients, Cayman accountholders, and travelers cheque 
purchasers all relied on the U.S. dollar services that HBMX was able to provide through its 
correspondent accounts at HBUS. In some cases, it appears those HBMX clients used HBMX's 
U.S. dollar correspondent account at HBUS to commit criminal acts. For its part, HBUS should 
have known of the money laundering risks it was incurring from those and other high risk 
HBMX clients, accounts, and products. Because HBMX was an HSBC affiliate and was also 
categorized for many years as located in a low risk jurisdiction, however, until recently, HBUS 
did not performed the KYC due diligence or account monitoring needed to uncover HBMX's 
high risk activities. 

E. Bulk Cash Movements 

In addition to using HBUS correspondent accounts to execute wire transfers, clear cash 
letter instruments, and conduct other U.S. dollar transactions, in 2007 and 2008, HBMX used its 
HBUS banknotes account to supply more physical U.S. dollars to HBUS than any other Mexican 
bank or HSBC affiliate. The documents indicate that both HBMX and HBUS were unaware of 
the flood of dollars HBMX was pouring into the United States through HBUS, in part because 
HBUS had stopped monitoring HSBC affiliates' banknotes accounts for a three- year period, 
from mid- 2006 to mid- 2009. HBUS policy was also consistent with the HSBC Group policy of 
not performing due diligence or account monitoring for HSBC affiliates. When, in 2008, 
Mexican and U.S. regulators began pressing both HBMX and HBUS to explain the huge flow of 
U.S. dollars from Mexico and whether the funds included illegal drug proceeds, both banks were 
caught by surprise and eventually took action to turn off the spigot. In 2009, HBMX stopped 
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accepting U.S. dollar deposits at its branches in Mexico, and then in 2010, HBUS exited the 
banknotes business. 

(1) HBUS' Global Banknotes Business 

Prior to its exit, HBUS operated a very large U.S. banknotes business which the Federal 
Reserve estimated in 2010, to be worth approximately $300 billion annually. 591 As part of that 
business, HBUS supplied physical U.S. dollars and accepted bulk cash shipments from financial 
institutions around the world, including over two dozen HSBC affiliates. 

Bulk cash shipments typically use common carriers, independent carriers, or U.S. Postal 
Service carriers to ship U.S. dollars by air, land, or sea to a bank located in the United States. 593 
Shipments have gone via airplanes, armored trucks, ships, and railroads. Most shipments are 
transported via containerized cargo. Shippers may be "currency originators," such as businesses 
that generate cash from sales of goods or services; or "intermediaries" that gather currency from 
originators or other intermediaries to form large shipments. Intermediaries are typically central 
banks, commercial banks, money service businesses, or their agents. 594 Bulk cash shipments can 
be made directly to a bank in the United States, or to a U.S. Federal Reserve Bank or branch, 
which will accept the cash and credit it to the account of the intended recipient bank. 595 Banks 
that receive bulk cash shipments via common carriers or the Postal Service have no obligation to 
report the amount of the cash received to U.S. authorities, though they still must report any 
suspicious activity. 596 

Until 2010, HBUS was one of about 30 U.S. financial institutions that bought and sold 
physical currency on a wholesale basis around the world. 597 The headquarters of HBUS' Global 
Banknotes business was located in New York, headed by Christopher Lok, with offices in 
London, Hong Kong, Singapore, and other locations. Until 2010, HSBC was also one of a 
relatively small number of international banks that contracted with the Federal Reserve Bank of 
New York (FRBNY), under the Extended Custodial Inventory (ECI) Program, to manage the 
FRBNY's U.S. currency vaults. The ECI Program facilitates the international distribution of 
U.S. dollars, repatriates old dollars, circulates new designs, and provides information on the 
international use of U.S. currency. 599 HSBC operated FRBNY currency vaults in London, 
Frankfurt, and Singapore. 600 The currency in those vaults remained on the books of the Federal 



1/12/2010 memorandum from the Federal Reserve, "US Department of Justice Investigation of HSBC Bank USA 
NA's ("HSBC Bank USA") Bank Note Business (Revised)," BOG-SR-000442-43, 001402-409. [Sealed Exhibit.] 

592 See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, OCC-PSI-00864335-365, at 342. [Sealed Exhibit.] 

593 1/12/2010 memorandum from the Federal Reserve, "US Department of Justice Investigation of HSBC Bank USA 
NA's ("HSBC Bank USA") Bank Note Business (Revised)," at BOG-SR-001404. [Sealed Exhibit.] 

594 Id. 

595 Id. 

596 Id., citing 31 CFR §103.23. 

597 Id. atBOG-SR-001405. 

598 See 11/2006 HBUS presentation, "Banknotes Trading A Global Reach Organizational Chart as of November 
2006," OCC_PSI-00000501-512. 

599 1/12/2010 memorandum from the Federal Reserve, "US Department of Justice Investigation of HSBC Bank USA 
NA's ("HSBC Bank USA") Bank Note Business (Revised)," at BOG-SR-001405. [Sealed Exhibit.] 
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Reserve, and was used to fill orders from third parties or the operator itself. When distributing 
U.S. dollars, HSBC was obligated to comply with U.S. AML and Office of Foreign Assets 
Control (OFAC) requirements. 602 

While bulk cash shipments are a normal and legitimate part of international banking, they 
are also vulnerable to misuse by money launderers and other criminals. In 2001, the U.S. 
Congress made smuggling large amounts of physical U.S. dollars across U.S. borders a crime. 603 
In 2005, a U.S. Money Laundering Threat Assessment identified bulk cash smuggling as a key 
method used to launder criminal proceeds and highlighted how drug traffickers were smuggling 
U.S. dollars obtained from illegal U.S. drug sales across the border into Mexico and then using 
various means to arrange for their deposit into a U.S. bank. 604 In 2006, the U.S. Financial 
Crimes Enforcement Network (FinCEN) issued an advisory to U.S. financial institutions warning 
them in particular about money laundering associated with bulk cash shipments from Mexican 
casas de cambios. 605 

As of 2010, 29 HSBC affiliates had banknotes accounts with HBUS. 606 Some of those 
affiliates operated in high risk countries plagued by drug trafficking, corruption, money 
laundering, or other criminal enterprises, including Angola, Bangladesh, Colombia, Democratic 
Republic of Congo, Haiti, Mexico, Panama, Paraguay, Saudi Arabia, and Ukraine. HBUS did 
not distinguish, however, between high and low risk affiliates with banknotes accounts. 



(2) HBMX U.S. Dollar Sales to HBUS 



For a three-year period, from mid- 2006 until mid-2009, HBUS accepted more than $15 
billion in physical U.S. dollars from other HSBC affiliates, but failed to conduct any AML 
monitoring of the bulk cash transactions. HBUS had performed AML monitoring both prior 
to and following that time period. HBUS personnel have been unable to explain why all AML 
monitoring of its banknotes accounts ceased during that period and then resumed later, but the 
OCC has noted that the monitoring ceased when a formal AML oversight agreement applicable 
to HBUS expired, and resumed when an OCC AML examination of the banknotes operations 
was launched in July 2009. The absence of AML monitoring meant that HBUS did not track 



601 Id. 

602 Id. 

603 See Section 371 of the USA Patriot Act, P.L. 107-56, codified at 31 USC §5332 (outlawing the smuggling or 
attempted smuggling of over $10,000 in currency or monetary instruments into or out of the United States, with the 
specific intent to evade U.S. currency reporting requirements). 

604 See Dec. 2005 "U.S. Money Laundering Threat Assessment," issued by the Money Laundering Threat 
Assessment Working Group, which included the U.S. Departments of Treasury, Justice, and Homeland Security, 
Federal Reserve, and Postal Service, Chapter 5 on "Bulk Cash Smuggling" ("Upon leaving the country, cash may 
stay in Mexico, continue on to a number of other countries, or make a U-turn and head back into the United States as 
a deposit by a bank or casa de cambio."). 

605 4/28/2006 "FinCEN Guidance to Financial Institutions on the Repatriation of Currency Smuggled into Mexico 
from the U.S.," No. FIN-2006-A003. 

606 See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, OCC-PSI-00864335-365, at 342. [Sealed Exhibit.] 

607 Id. at 00864336. 

608 See id. at 00864360. When asked why HBUS stopped monitoring its affiliates' banknotes activity, HBUS 
personnel offered conflicting reasons. Daniel Jack, in charge of HBUS compliance for banknotes, thought that his 
supervisor, Alan Ketley, had approved the decision to stop monitoring affiliates, but Alan Ketley did not recall the 
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its growing dollar traffic with HBMX, which reached $3 billion in 2007, and then jumped 
another 25% in 2008 to $4 billion. 609 

In February 2008, Mexican regulators held a private meeting with HBMX CEO Paul 
Thurston and informed him that HBMX was repatriating more U.S. dollars to the United States 
than any other Mexican bank - more than each of the four largest Mexican banks, all of which 
were larger than HBMX. 610 The CNBV also informed Mr. Thurston that the Mexican Financial 
Intelligence Unit (FIU) was very concerned about the "high level of ML [money laundering] 
risk" involved. 611 The FIU indicated that in the "majority of the most relevant ML cases" they 
had investigated in 2007, "many transactions were carried out through" HBMX. 612 

In November 2008, the CNBV and FIU held a second private meeting, not only with the 
HBMX CEO, then Luis Pena, but also with the HSBC CEO of Latin America, Emilson Alonso, 
and the CEO of the HSBC Group, Michael Geoghegan. 613 Again, the regulators expressed their 
alarm at the volume of U.S. dollars that HBMX was sending to the United States and described 
law enforcement concerns about the extent to which those dollars may be the proceeds of illegal 
drug trafficking in the United States. A November email from the HSBC Group Compliance 
Deputy Head summarizing the meeting stated that, between January and September 2008, 
HBMX had repatriated $3 billion to the United States, which represented 36% of the market 
volume and double what the biggest bank in Mexico, Banamax, had repatriated, even though 
HBMX was only the fifth largest bank in the country. 614 According to an internal OCC 
document, the Department of Homeland Security's Immigration and Customs Enforcement 
(ICE) division conveyed that, within Mexico, HBMX "led the market in cash repatriation in 
2007 and 2008," with "$3.2 billion repatriated in 2007 and $4.2 billion repatriated in 2008." 615 

A quick analysis undertaken by HBMX immediately after the November meeting found 
that while HMBX was "very good at buying/acquiring dollars," it did "not seem to sell them and 
hence our very high repatriation figures." 61 The analysis also determined that "80% of our 
dollars come from money exchange business at branches." 617 It noted further that "there is no 
limit on the amount of dollars that c[u]stomers can convert to pesos," and that with respect to 



decision. Neither did their superior, Teresa Pesce. David Bagley called the decision to stop monitoring banknotes 
for affiliates "inexplicable." Subcommittee interviews of Daniel Jack (3/13/2012), Alan Ketley (2/16/2012), Teresa 
Pesce (3/30/2012) and David Bagley (4/12/2012). 

609 Id.; 6/29/2009 OCC notes of telephone conversations, prepared by OCC AML Examiner Joseph Boss, OCC-PSI- 
00928760. 

610 See 2/18/2008 draft report entitled, "Internal Control, HBC Mexico, S.A.," prepared by CNBV, HSBC OCC 
8966021-026, at 5. 

611 Id. 

612 Id. at 6. Examples of these cases included Zhenly Ye Gon, Casa de Cambio Puebla, and Sigue Corporation. 

613 See 1 1/27/2008 email from HSBC Warren Learning to HSBC David Bagley and Richard Bennett, "Mexico," 
HSBC OCC 8875605-607. 

614 1 1/27/2008 email from HSBC Warren Learning to HSBC David Bagley and Richard Bennett, "Mexico," HSBC 
OCC 8875605-607, at 606. 

615 6/29/2009 OCC notes of telephone conversations, prepared by OCC AML Examiner Joseph Boss, OCC-PSI- 
00928760. 

616 1 1/27/2008 email from HSBC Warren Learning to HSBC David Bagley and Richard Bennett, "Mexico," at 
HSBC OCC 8875606. 
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non-customers, HBMX branches would "convert up to 3000 dollars, and do not require any 
KYC." 618 HSBC Group Compliance head David Bagley responded: "The practice of changing 
USD in the branches pres[u]mably with little or no ID for non customers is in breach of Group 
policy. When looking at our USD exposure how can this have been missed." 619 

At HBUS, an undated analysis was conducted of its banknotes traffic with Mexican 
financial institutions over a three-month period, from November 2006 to February 2007. 620 The 
analysis disclosed that HBUS was doing far more business with HBMX than any other Mexican 
financial institution. It showed that during the three-month period: 

-HBUS had purchased about $470 million in U.S. dollars from Banco Mercantil Del 
Norte, a major Mexican bank, while selling it only about $22 million in U.S. dollars. 

-HBUS had purchased about $281 million in U.S. dollars from BBVA Bancomer, 
another major Mexican bank, while selling it only about $5 million. 

-HBUS had purchased about $196 million in U.S. dollars from Case de Cambio Puebla, 
and $194 million from Consultoria International, without selling either any U.S. dollars. 

-During the same period, HBUS had purchased about $742 million in U.S. dollars from 
HBMX, while selling it only a little more than $1.3 million. 

These figures indicate that HBMX was, by far, HBUS' largest banknotes customer in Mexico, 
something that HBUS would not have known at the time since it had stopped monitoring 
banknotes transactions involving affiliates. 

In July 2009, the OCC initiated an AML examination of HBUS' global banknotes 
operations, and soon discovered that the bank was not monitoring the banknotes activities of its 
affiliates. 621 That same month, HBUS resumed monitoring its banknote accounts. In 
September, the OCC requested documentation related to banknotes accounts for 25 Latin 
American financial institutions, including ten in Mexico. In November 2009, the examination 
team added examiners from the Federal Reserve. Additional requests for information were 
made, including with respect to HSBC affiliates with banknotes accounts, HBMX, Mexican 
casas de cambios, and HBMX's U.S. dollar accounts in the Cayman Islands. 



1 1/27/2008 email from HSBC David Bagley to HSBD Warren Learning, copy to Richard Bennett, "Mexico," 
HSBC OCC 8875605. 

620 See undated "HBUS Banknotes NY - USD Bought from or Sold to Customers in Mexico: 3-Month Period 
(Nov-06 to Feb-07)," prepared by HBUS, OCC-PSI-00151506. See also undated "Banknotes-NY Selected 
Customers' Activity Alerts & Traders' Explanations for USD Purchases & Sales from 2005-2009," prepared by 
HNAH, OCC-PSI-00005890-904. 

621 See 2/6/2010 email from HBUS Janet Burak to HBUS Brendan McDonagh, "Expanded 'Banknotes Exam,'" 
OCC-PSI-00787479 (summarizing the banknotes examination effort). See also Subcommittee interview of Joseph 
Boss (1/30/2012). 

622 See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, OCC-PSI-00864335-365, at 360. [Sealed Exhibit.] 
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In August 2009, the OCC summarized some of the information in an internal 
memorandum. 623 According to the OCC, due to transaction costs, banknotes transactions at 
HBUS typically occurred only about once per month and involved large shipments. 624 In 
addition, transaction volumes often fluctuated on a seasonal basis, increasing during holidays or 
tourist seasons. 625 According to the OCC, HBUS said that it conducted AML monitoring on a 
monthly basis, examining banknotes transactions by customer and inquiring when significant 
changes in the volume of U.S. dollar sales or purchases took place. 626 

When the OCC conducted tests on the 2009 HBUS banknotes data, however, it 
determined that the volume data was not always accurate, and HBUS did not keep records of its 
reviews or actions: 

"When volumes changed significantly, the bank did not seem to be aware of these 
changes, and it does not appear that the bank took any action as a result. For example, 
even though transactions volumes for customers in Mexico increased significantly from 
the first 6 months of 2008, over the first 6 months of 2009, there was no documentation 
in the files that the bank noted the change or took any action. . . . Bank employees . . . 
assured us that adequate monitoring takes place within the business line and Compliance. 
However, we were unable to find anything in the files that this was the case. They also 
cautioned that too much documentation results in increased legal risk. We explained to 
the bank that written documentation is necessary, for institutional memory, and to ensure 
that controls are exercised. We noted the bank's appetite for risk, as well as the risk 
inherent in the Banknotes business. The business line seemed to resist this message, but 
Compliance staff seemed to eventually grasp the importance of better documentation." 

As the data confirmed that HBMX was the single largest supplier of U.S. dollars to 
HBUS, transferring billions of dollars that far outstripped the volumes being supplied by larger 
Mexican banks and other HSBC affiliates, Mexican and U.S. law enforcement and regulatory 
authorities continued to express concern that HBMX's bulk cash shipments could reach that 
volume only if they included illegal drug proceeds. In a January 2010 meeting, U.S. law 
enforcement and regulators also expressed concern that the problem extended beyond Mexico: 

"The bulk cash receipts by HSBC's Bank Note Business from certain correspondent 
accounts based in Central and South America exceed reasonably expected volumes of 
USDs that should be within those countries from tourism, foreign business, etc." 



623 See 8/13/2009 OCC memorandum to OCC AML Examiners from the OCC Compliance Risk Analysis Division, 
"HSBC Global Banknotes, Compliance RAD assistance," OCC-PSI-00846642. [Sealed Exhibit.] 

624 Id. at 4. 

625 Id. 

626 Id. 

627 Id. at 4-5. 

628 1/1 1/2010 meeting memorandum, prepared by the Federal Reserve Bank of Chicago, "DOJ Concerns with HSBC 
Bank Notes Activities," BOG-SR-001402-1409, at 402 [Sealed Exhibit.] 
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(3) Remedial Action 

In response to the concerns expressed by regulators and law enforcement, HBMX took a 
number of steps to gain a better understanding and control of its U.S. dollar transactions. The 
first set of actions, in February 2008, focused on gaining better information. HBMX announced 
a new policy, effective immediately, to deem all customers who deposited more than $100,000 in 
a month as SCC clients subject to enhanced due diligence. HBMX identified 312 customers that 
met that criteria and subjected them to a KYC review. 629 HBMX also undertook a review of its 
branches to identify the nature and volume of their U.S. dollar transactions, and a review of its 

63 1 

money service business clients to determine whether each relationship should continue. Still 
another action HBMX took was to change its account monitoring criteria to increase scrutiny of 
U.S. dollar deposits by customers. 632 

In November 2008, after another meeting with regulators critical of its U.S. dollar 
transactions, HBMX went further. It ordered its branches to stop providing physical U.S. dollars 
to customers and non-customers alike, other than through ATMs at airports. 633 It also prohibited 
branches from accepting U.S. dollar cash deposits from customers. 634 In addition, HBMX 
stopped opening new U.S. dollar accounts at its Cayman branch, and prohibiting the acceptance 
of new cash deposits for existing Cayman accounts. 635 All of these actions led to a steep drop in 
the number and volume of HBMX U.S. dollar transactions. 

As HBMX cut back dramatically on its U.S. dollar business beginning in early 2009, 
OCC AML examiners found that HBUS appeared to be increasing its U.S. dollar transactions 
with Mexican clients, including some of the high risk casas de cambio that could no longer 
engage in the same volume of U.S. dollars with HBMX. 636 HSBC Group Compliance knew 
about HBUS' Mexican casa de cambio clients. Rather than press HBUS to close the accounts, 



bzv See undated "Actions taken since 18FEB," prepared by HBMX, HSBC OCC 8875040-041(describing actions 
taken after a Feb. 18, 2008 meeting with the CNBV); 3/3/2008 "Internal Control, HSBC Mexico SA," prepared by 
HBMX, HSBC OCC 8966027-038. But see 7/28/2008 email from HBMX Luis Alverez to HSBC John Root and 
HBMX Ramon Garcia, "Major Issues Outstanding," HSBC OCC 8873598 ("In order to mitigate risk in HBMX, 
100K process was implemented (customers which make USD cash deposits exceeding 100k within a one-month 
period). It has been identified that 974 customers made cash deposits for a total amount of USD308 Million from 
Jan to May. These customers are classified in our monitoring systems as high-risk customers and an enhanced KYC 
must be performed for them. If any customers do not meet requirements, accounts are closed."). 

630 See, e.g., undated "Rectification Programme - 12 major projects in 6 categories," prepared by HBMX, HSBC 
OCC 8875046 (listing as item 5, on "USD Banknotes": "Review of USD intensive customers" and "Analysis of 
transaction patterns through branches"). 

631 7/28/2008 email from HBMX Luis Alverez to HSBC John Root and HBMX Ramon Garcia, "Major Issues 
Outstanding," HSBC OCC 8873598. 

632 Undated "Actions taken since 18FEB," prepared by HBMX, HSBC OCC 8875040-041(describing actions taken 
after a Feb. 18, 2008 meeting with the CNBV). 

633 See 1 1/27/2008 email from HBMX Luis Pena to HBMX Emilson Alonso, copy to HSBC Michael Geoghegan, 
"Money Launderying," HSBC OCC 8874849. 

634 Id. 

635 1 1/27/2008 email from HSBC Warren Learning to HSBC David Bagley and Richard Bennett, "Mexico," HSBC 
OCC 8875605-607. 

636 See, e.g., 9/1/2009 OCC memorandum to the Files, "Washington Meeting," OCC-PSI-01416833 ("[0]nce 
HSBC Mexico ceased its operations, HBUS began significant volume of Banknote activity directly with some of 
HSBC Mexico's former Banknote clientele."). [Sealed Exhibit.] 
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however, HSBC Group Compliance head David Bagley merely observed to a colleague in 
January 2009: "I am surprised that HBUS still have cambio clients." 637 

A year later, in June 2010, HBUS decided to exit the U.S. banknotes business. It closed 
the Global Banknotes offices in New York, London, Hong Kong, and Singapore, and later sold 

638 

portions of the business to other banks. HBUS also declined to renew its contract to operate 
U.S. currency vaults for the Federal Reserve Bank of New York when that contract expired in 
2010. In September 2010, the OCC issued a supervisory letter identifying multiple AML 
deficiencies at HBUS, including with respect to its banknotes business, and followed with a 
cease and desist order in October. 

F. Analysis 

Over the years, HBUS maintained correspondent accounts for at least 80 HSBC affiliates 
and banknotes accounts for at least 29 HSBC affiliates, which accounted for a large portion of its 
U.S. dollar activities. In 2009, for example, HSBC determined that "HSBC Group affiliates 
clear[ed] virtually all USD [U.S. dollar] payments through accounts held at HBUS, representing 
63% of all USD payments processed by HBUS." 639 HSBC also calculated that, over an eight- 
year period, its U.S. dollar clearing business had increased over 200%, from processing an 
average daily amount of $185 billion in 2001, to $377 billion in 2009. 640 HBUS functioned as 
the U.S. nexus for the entire HSBC global network of financial institutions. Some of those 
institutions used their access to the U.S. financial system as a selling point to attract clients. 641 
Not all of those affiliates operated in high risk jurisdictions like Mexico; not all had high risk 
clients like casas de cambio; not all had high risk products like U.S. dollar Cayman accounts; and 
not all had weak AML controls. But some HSBC affiliates operated under those circumstances, 
and HBMX provides a case history of the money laundering risks that followed. HBMX 
illustrates how the U.S. affiliate of a global bank can better protect itself by conducting careful 
due diligence of fellow affiliates, as already required by law, identifying higher risk institutions, 
and understanding their high risk clients, high risk products, AML controls, and money 
laundering vulnerabilities. HBMX also illustrates the need for ongoing, effective account 
monitoring to detect, prevent, and report suspicious activity. Effective monitoring and SAR 
reporting require adequate resources and personnel. Still another lesson is that AML personnel 
at the parent and affiliates of a global bank should consider all legal avenues for systematically 
sharing information with each other about suspicious clients and transactions in order to combat 
misuse of their network by drug traffickers, organized crime, and other wrongdoers. 



1/27/2009 email from HSBC David Bagley to HSBC Susan Wright and Warren Learning, "Press Release," 
HSBC OCC 8873485. 

638 Id. In 2010, HSBC Holdings pic sold its U.S. wholesale banknotes business in Asia to United Overseas Bank 
Limited (UOB) for $1 1 million, and in 201 1, sold its European banknotes business to HSBC Bank pic. It recorded 
total closure costs of $14 million during 2010. Id. 

639 See 9/9/2009 chart entitled, "HSBC Profile," included in "HSBC OFAC Compliance Program," a presentation 
prepared by HSBC and provided to the OCC, at HSBC OCC 8874197. 

640 Id. at "USD Payment Statistics - Fact Sheet," HSBC OCC 887421 1. 

641 Subcommittee interview of Michael Geoghegan (5/42/2012). 
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IV. HSBC AFFILIATES: CIRCUMVENTING OFAC PROHIBITIONS 

The United States prohibits doing business with certain persons and entities, including 
terrorists, persons engaged in nuclear proliferation, drug kingpins, and persons associated with 
rogue jurisdictions such as Iran, North Korea, and Sudan. To implement the law, the U.S. 
Treasury Department's Office of Foreign Assets Control (OFAC) has developed a list of those 
prohibited persons and countries which banks use to create an "OFAC filter" to identify and halt 
potentially prohibited transactions. Transactions stopped by an OFAC filter typically undergo an 
individualized review to see if the transaction can proceed. 

Foreign banks that engage in U.S. dollar transactions typically execute them through the 
account of a bank in the United States, subject to the U.S. bank's OFAC filter. While most 
processing takes less than 24 hours, transactions stopped by the OFAC filter for further review 
may undergo substantial processing delays and, in some cases, payments may be blocked and 
held for years. Because of the additional time and expense involved when transactions are 
subjected to review, some foreign banks have developed a variety of tactics to avoid the OFAC 
filter. Common tactics included intentionally stripping information from the transaction 
documentation to conceal the participation of a prohibited country or person, or using "cover 
payments." In the context of Iranian transactions, cover payments are transfers between 
correspondent banks in non-sanctioned jurisdictions which lack underlying payment details, 
including information about a party that is a prohibited country or person. In the case of Iranian 
U.S. dollar transactions, some banks used one or both of these practices when conducting so- 
called "U-turn" transactions, a type of transaction that was allowed under OFAC regulations 
prior to November 2008, but because the transactions referenced Iran, routinely triggered the 
OFAC filter and required an individualized review which delayed the transaction's processing. 
In recent years, U.S. law enforcement has penalized some international banks that used willfully 
deceptive tactics to circumvent the OFAC filter and process prohibited transactions. 

The Subcommittee conducted a review of issues related to the sending of OFAC sensitive 
transactions through HBUS' correspondent accounts from 2000 to 2010, by HSBC affiliates. 
The evidence indicates that, for years, some HSBC affiliates sending OFAC sensitive 
transactions involving Iran through their U.S. dollar correspondent accounts at HBUS took steps 
to conceal them, including by deleting references to Iran from the payment instructions or by 
characterizing the transaction as a transfer between banks in permitted jurisdictions without 
disclosing any Iranian connection. More specifically, from at least 2001 to 2007, two HSBC 
affiliates, HSBC Europe (HBEU) and later HSBC Middle East (HBME), repeatedly conducted 
U-turn transactions involving Iran through HBUS, many of which were not disclosed to the 
bank, even though they knew HBUS required full transparency to process U-turns. To ensure 
HBUS cleared the transactions without delay, HBEU routinely altered transaction documentation 
to delete any reference to Iran that might trigger the OFAC filter at HBUS and also typically 
characterized the transaction as a transfer between banks in permitted jurisdictions. The aim of 
the affiliates' efforts appeared to be to ensure the Iranian transactions utilized HBUS' automated 
processing procedures and avoided any human intervention or manual review, a process known 
as straight through processing or STP. Internal bank documents also indicate that the affiliates 
viewed the U-turns they sent through HBUS' accounts as permitted by OFAC rather than 
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prohibited transactions under U.S. law, but their failure to provide full transparency prevented 
any individualized review by HBUS to confirm their legality. 

Internal bank documents show that HSBC Group Compliance knew of HBUS' insistence 
on full transparency for U-turns and the practice of HSBC affiliates to conceal the Iranian 
transactions sent through their U.S. dollar correspondent accounts at HBUS. HSBC Group 
Compliance, as well as other senior HSBC Group executives, allowed the HSBC affiliates to 
continue to engage in these practices, which even some within the bank viewed as deceptive, for 
more than five years without disclosing the extent of the activity to HBUS. The bank documents 
show that, from 2000 to 2005, the practice of altering U-turn transaction documentation was 
repeatedly brought to the attention of HSBC Group Compliance, including by HBEU personnel 
who objected to participating in the alteration of documents and twice announced deadlines to 
end the activity. Despite receiving this information, HSBC Group Compliance did not stop 
HSBC affiliates from sending concealed Iranian transactions through HBUS' accounts until the 
bank decided to exit Iran altogether in 2007. 

At the same time, while some at HBUS claimed not to have known they were processing 
undisclosed Iranian transactions from HSBC affiliates, internal documents show key senior 
HBUS officials were informed as early as 2001. In addition, on several occasions, HBUS' 
OFAC filter stopped Iranian transactions that HBUS had indicated should be disclosed by HSBC 
affiliates, but were not. Despite the evidence of what was taking place, HBUS failed for years to 
demand a full accounting of what HSBC affiliates were doing. While HBUS insisted, when 
asked, that HSBC affiliates provide fully transparent transaction information, when it obtained 
evidence that some affiliates were acting to circumvent the OFAC filter, HBUS failed to take 
decisive action to confront those affiliates, stop the conduct, and ensure all Iranian U-turns were 
subjected to individualized reviews to gauge whether they complied with the law. 

In addition to Iranian transactions, HBUS documents indicate that, from at least 2002 to 
2007, some HSBC affiliates also sent potentially prohibited transactions through HBUS 
involving Burma, Cuba, North Korea, or Sudan, although none of the affiliates employed the 
same type of systematic effort used for transactions involving Iran. In recent years, HBUS' 
OFAC compliance program as a whole has also displayed AML deficiencies. 

In 2010, HBUS hired an outside auditor, Deloitte LLP, to identify and examine the 
OFAC sensitive transactions involving Iran and other prohibited countries or persons that went 
through the bank. 642 That review, which is ongoing and has yet to review all relevant 
transactions, has so far identified, over a seven-year period from 2001 to 2007, more than 28,000 
OFAC sensitive transactions sent through HBUS involving a total of $19.7 billion. Of those 
28,000 transactions, more than 25,000 totaling more than $19.4 billion involved Iran, while 
3,000 involved other prohibited countries or persons. The Deloitte review characterized 2,584 of 
those transactions, involving assets in excess of $367 million, 79 of which involved Iran, as 
"Transactions of Interest" requiring additional analysis to determine whether violations of U.S. 



See Deloitte Review of OFAC transactions, "Results of the Transactions Review - UK Gateway, March 29, 
2012," HSBC-PSI-PROD-0197919 at 930. 
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law occurred. HBUS is currently in the process of analyzing those transactions, which could 
lead to financial penalties if it is found to have violated OFAC regulations. 

Finally, another issue involves actions taken by some HSBC Latin American affiliates, 
with the approval of HSBC Group Compliance, to send non-U. S. dollar payment messages 
through a U.S. server whose OFAC filter was not turned on to screen them for terrorists, drug 
kingpins, or other prohibited persons. HSBC Group Compliance allowed those payment 
messages to move through the United States and utilize U.S. facilities while bypassing the OFAC 
filter, despite HBUS concerns that such messaging traffic might require OFAC screening to 
block transfers involving terrorism, drug trafficking, or other wrongdoing. The transactions were 
later screened by HSBC Group's WOLF filter. 

A. Background on OFAC Prohibitions 

OFAC. The Office of Foreign Assets Control (OFAC) within the U.S. Department of 
Treasury administers and enforces economic and trade sanctions stemming from U.S. foreign 
policy and national security goals, and other threats to the foreign policy, national security, or 
economy of the United States. 644 The office was formally established in December 1950, during 
World War II, when President Truman blocked all Chinese and North Korean assets subject to 
U.S. jurisdiction. 645 Its programs seek to prohibit U.S. persons and entities from engaging in 
trade or financial transactions with terrorists, persons engaged in activities related to the 
proliferation of weapons of mass destruction, international narcotics traffickers, and rogue 
jurisdictions. 

OFAC's regulatory authority is exercised under Presidential national emergency powers 
and laws enacted by the U.S. Congress to impose controls on transactions and authorize the 
freezing of assets under U.S. jurisdiction. According to OFAC, "[m]any of the U.S. sanctions 
are based on United Nations and other international mandates, are multilateral in scope, and 
involve close cooperation with allied governments." 646 The freezing of assets "immediately 
imposes an across-the-board prohibition against transfers or dealings of any kind with regard to 
the property," and the owner of the asset must contact OFAC directly to request the release of a 
frozen asset. OFAC prohibitions support U.S. and international efforts to combat terrorism, 
nuclear proliferation, drug trafficking, and other wrongdoing. 

OFAC administers both comprehensive and selective sanctions programs. The 
comprehensive U.S. programs apply to persons and entities within a designated jurisdiction and 
have applied to Burma (Myanmar), Cuba, Iran, Sudan, and Syria. The non-comprehensive 
programs target specific individuals and entities rather than impose broad prohibitions involving 
an entire country. These programs have applied at times to persons and entities associated with 
Iraq, Libya, North Korea, Somalia, and Zimbabwe. To carry out U.S. sanctions programs, 



See U.S. Department of Treasury Office of Foreign Assets Control (OFAC), http://www.treasury.gov/about/ 
organizational-structure/offices/Pages/Office-of-Foreign-Assets-Control.aspx. 

645 Id. OFAC is the successor to the Office of Foreign Funds Control (the "FFC") that was established at the 
beginning of World War II in 1940. However, the Treasury Department administered sanctions as far back as the 
War of 1812 when sanctions were imposed against Great Britain. Id. 
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OFAC has developed a list of Specially Designated Nationals and Blocked Persons (SDN). The 
SDN designation covers both individuals and entities in which SDN persons have a direct or 
indirect ownership interest of 50% or more. The SDN designation applies to covered entities 
whether or not the entity is named on the SDN list. 647 U.S. persons are prohibited from dealing 
with persons and entities on the SDN list, and all SDN assets in the United States are supposed to 
be blocked. OFAC also has authority to grant general and specific "licenses," which authorize 
exceptions for certain categories of transactions, such as those related to humanitarian efforts. 

OFAC regulations apply to all U.S. persons, both citizens and permanent resident aliens, 
regardless of where they are located, as well as all persons and entities within the United States, 
and all U.S. incorporated entities and their foreign branches. 649 Fines for violating U.S. sanction 
laws and OFAC regulations can be substantial. Criminal penalties can result in fines ranging 
from $50,000 to $10 million and imprisonment for 10 to 30 years for willful violations. Civil 
penalties range from $250,000 or twice the amount of each underlying transaction to $1,075,000 
for each violation. 650 



Iran and U-turn Transactions. For more than thirty years, dating back to 1979, the 
United States has applied sanctions programs to Iran, enforced by OFAC. 651 These programs 
have generally prohibited U.S. persons from engaging in transactions with anyone associated 
with Iran, and the OFAC filter has stopped any financial transaction including an Iranian 
reference. 



Between 1995 and November 10, 2008, however, OFAC regulations also included an 
exception to the prohibition on Iranian transactions commonly referred to as "U-turns." U-turn 
transactions were authorized by OFAC under regulations issued in 1995. In that year, President 
Clinton declared that Iran was an international threat for its attempt to obtain a nuclear weapon 
as well as its role in undermining ongoing peace talks in the Middle East. As such, U.S. 
financial institutions were generally barred by OFAC from processing transactions involving 
Iran. In their place, OFAC allowed only those Iran-related transactions that began and ended in 
non-Iranian foreign banks. According to Treasury: 

"This is commonly referred to as the ' 'U-turn' ' authorization. It is so termed because it 
is initiated offshore as a dollar-denominated transaction by order of a foreign bank's 
customer; it then becomes a transfer from a correspondent account held by a domestic 



See OFAC website, FAQ #10: http://www.treasury.gov/resource-center/faqs/Sanctions/Pages/ques_index.aspx 

648 See OFAC web site, FAQ #10: http://www.treasury.gov/resource-center/faqs/Sanctions/Pages/ques_index.aspx 

649 See OFAC website, FAQ #11: http://www.treasury.gOv/resource-center/faqs/Sanctions/Pages/answer.aspx#10 

650 See U.S. Department of Treasury Office of Foreign Assets Control (OFAC), http://www.treasury.gov/about/ 
organizational-structure/offices/Pages/Office-of-Foreign-Assets-Control.aspx. 

651 See 31 C.F.R. Part 535, Iranian Assets Control Regulations, and 31 C.F.R. Part 560, Iranian Transactions 
Regulations, which together comprise the Iranian sanctions program. Initial Iranian sanctions regulations, now 
detailed in Part 535, were created on November 14, 1979, after U.S. diplomats were taken hostage in Tehran, and 
President Carter blocked assets located in the United States belonging to the Government of Iran. On October 29, 
1987, following Iran's expressions of support for international terrorism and aggressive actions against non-hostile 
shipping in the Persian Gulf, President Reagan issued Executive Order 12613, the predecessor to Part 560. From 
1995 to 1997, President Clinton issued three additional Executive Orders, numbered 12957, 12959, and 13059, 
which culminated in a prohibition of nearly all trade and investment activities with Iran by U.S. persons, regardless 
of location. 
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bank for the foreign bank to a correspondent account held by a domestic bank for another 
foreign bank; and it ends up offshore as a transfer to a dollar-denominated account of the 
second foreign bank's customer." 

In essence, the new regulations only allowed U.S. financial institutions to clear U.S. 
dollar transactions involving non-Iranian intermediaries, even if they involved Iranian clients. 
This restriction meant transactions involving Iran could be processed only if the beginning and 
ending points were non-Iranian foreign banks. The purpose of U-turn transactions was to allow 
U.S. dollar-denominated transactions to continue throughout the world - benefitting both U.S. 
commerce and the value of the dollar - but to prevent U.S. citizens and institutions from doing 
business with Iran. This goal was accomplished by ensuring that the only point such transactions 
touched the United States was in clearing them for foreign banks. 

The U-turn exception was widely used to carry out U.S. dollar Iranian transactions in the 
United States for many years. In November 2008, the exception was revoked, and it was no 
longer legal under OF AC regulations to clear Iran-linked transactions even for foreign banks, 
although U.S. banks were still permitted to handle Iranian funds in limited circumstances, 
including transactions supporting humanitarian relief. U.S. persons were explicitly prohibited, 
however, from engaging in any transaction or dealing in any property or property interest with 
any Iranian bank designated under the Nonproliferation of Weapons of Mass Destruction or 
Specially Designated Global Terrorist programs. 654 

The U-turn exception for Iran in OFAC regulations until 2008 does not appear in any 
other OFAC regulation, and so does not affect transactions involving any other prohibited 
country or person. 

Prosecutions for OFAC Violations. In recent years, a number of large, international 
banks have been prosecuted for systematically violating OFAC prohibitions. In most cases, the 
violations involved the practice of stripping information from wire transfer documentation to 
hide the participation of a prohibited person or country, and executing the prohibited transaction 
through a U.S. dollar account at a U.S. financial institution. For example, in December 2009, 
Credit Suisse was fined $536 million by the Department of Justice for altering wire transfer 
documentation from 1995 to 2006, in transactions involving Burma, Cuba, Iran, and Libya. That 
same month Lloyd's Bank was fined $217 million for stripping information from wire 
transactions over a ten-year period, from the mid 1990s through September 2007. In May 2010, 
ABN Amro was fined $500 million for removing information from wire transfers involving 
OFAC sanctioned countries between 1995 and 2005. 

Most recently, on June 12, 2012, the U.S. Justice Department and New York District 
Attorney entered into a deferred prosecution agreement with ING Bank N.V. and imposed the 



See Treasury website, http://www.treasury.gov/resource-center/sanctions/Documents/fr73_66541.pdf; OFAC 
website, http://www.treasury.gov/about/organizational-structure/offices/Pages/Office-of-Foreign-Assets- 
Control.aspx, at 2. 

653 See OFAC website, http://www.treasury.gov/about/organizational-structure/offices/Pages/Office-of-Foreign- 
Assets-Control.aspx, at 2. 
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largest fine ever levied against a bank for OFAC violations. For processing more than $2 
billion in transactions on behalf of Cuban, Iranian, and other prohibited persons, ING Bank 
agreed to a criminal forfeiture of $619 million. The Treasury Department's press release 
revealed that ING Bank had "intentionally manipulated financial and trade transactions to 
remove references to Iran, Cuba, and other sanctioned countries and entities." 656 It noted that 
ING Bank's methods included not referencing a payment's origin, utilizing "misleading" 
payment messages, and using shell companies. According to court filings, between the early 
1990s and 2007, ING Bank processed more than 20,000 transactions in violation of OFAC 
prohibitions, "with the knowledge, approval and encouragement of senior corporate managers 
and legal and compliance departments." 657 

A summary of recent prosecutions and legal actions related to OFAC violations follows. 



Recent Prosecutions and Legal Actions Related to OFAC Violations 



Bank 


Date 


Fine 


Link 


Brief Summary 


ING Bank 
N.V. 


6/12/2012 


$619 million 


• DOJ Press Release 


The Department of Justice and the New York County 
District Attorney's Office entered into simultaneous 
deferred prosecution agreements with ING Bank 
relating to 20,000 transactions totaling $1.6 billion 
processed through the U.S. financial system on behalf 
of Cuban and Iranian entities from the early 1990s 
through 2007. 


Barclays 


8/18/2010 


$298 million 


• DOJ Press Release 

• Wall Street Journal, Probe 
Circles Globe to Find Dirty 
Money 


The Department of Justice and the New York County 
District Attorney's Office entered into deferred 
prosecution agreements with Barclays Bank for 
activity relating to transactions illegally conducted for 
customers in Cuba, Iran, Libya, Sudan and Burma 
from the mid-1990s until September 2006. 


ABN Amro 


5/10/2010 


$500 million 


• DOJ Press Release 

• Wall Street Journal, RBS, 
DOJ to End Deferred 
Prosecution Agreement 
over ABN Amro 


The Department of Justice entered into a deferred 
prosecution agreement with ABN Amro Bank for 
removing information from wire transfers from 1995- 
2005 for customers in Iran, Libya, the Sudan, Cuba 
and other OFAC- listed countries. 


Credit Suisse 


12/16/2009 


$536 million 


• DOJ Press Release 

• DOJ Statement of Facts 


The Department of Justice entered into a deferred 
prosecution agreement with Credit Suisse. The fines 
related to alterations on wire transfers from 1995 to 
2006 from Iran, Cuba, Burma and Libya. 



655 See, e.g. United States v. Ing Bank, N.V. , Case No. I:12crl36 (USDC DDC), Information (6/12/2012) and 
Deferred Prosecution Agreement (6/12/2012). 

656 6/12/2012 "ING Bank N.V. Agrees to Forfeit $619 Million For Illegal Transactions With Cuban and Iranian 
Entities," Treasury press release, www.treasury.gov/press-center/press-releases/Pages/tgl612.aspx. 
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Lloyd's Bank 


01/09/2009 


$217 million 


• DOJ Press Release 


The Department of Justice and the New York County 
District Attorney' s Office entered into deferred 
prosecution agreements with Lloyd's Bank for wire 
stripping transactions from the mid 1990s through 
September 2007. 


Australia and 
New Zealand 
Bank Group 
Ltd 


8/24/2009 


$5.75 million 


• Treasury Settlement 
Statement 

• Enforcement Documents 


The Treasury Department entered into a settlement 
with the Australia and New Zealand Bank Group 
relating to currency exchanges from 2004 to 2006, for 
transactions processed through US correspondent 
accounts for customers in Cuba and Sudan. 



Prepared by U.S. Permanent Subcommittee on Investigations, July 2012 



HSBC is currently under investigation by the U.S. Justice Department and several federal 
financial regulatory agencies for engaging in similar practices in possible violation of OFAC 
regulations. 658 In October 2010, an internal Federal Reserve email discussing HSBC's decision 
to hire an outside auditor to review its records "presumably to find problematic transfers," noted 
that "HSBC was one of the two major UK banks for Iranian banks during the early 2000s 
(Lloyds being the other), so we can imagine what will be found." 659 

B. Executing OFAC-Sensitive Transactions 

(1) Transactions Involving Iran 

(a) Overview 

Documents collected by the Subcommittee do not pinpoint when undisclosed Iranian 
transactions began moving through HBUS in potential violation of OFAC regulations. HSBC 
officials were aware of the practice generally as early as 2000, as seen in an email discussion 
between HSBC Group's Compliance head, then Matthew King, and AML head Susan Wright. 
Ms. Wright criticized actions taken by an unrelated bank to alter transaction documentation to 
disguise a wire transfer moving through the United States, but their email exchange does not 
disclose whether such transactions were already taking place at HBUS. 660 By 2001, they clearly 
were, as described in an email from HBEU to HBUS. 661 

In 2001, when HSBC Europe (HBEU) raised the issue of processing U-turn transactions 
through its U.S. account in compliance with U.S. requirements, HBUS personnel made it clear 
that any such transactions would need to be fully transparent and include all underlying payment 
details to enable HBUS to evaluate whether they qualified as permissible U-turns. From at least 
2001 to 2007, however, despite repeated HBUS requests for full transparency, HBEU and later 
HSBC Middle East (HBME) sent transactions involving Iran through their U.S. dollar 



See 2/27/2012 HSBC Holdings pic 6-K filing with the Securities and Exchange Commission, item 13, 
http://sec.gov/Archives/edgar/data/10891 13/0001 19163812000216/hsba201202276k7.htm . 

659 10/07/2010 email from Fed Stephen Meyer to Fed Kwayne Jennings and others, "HSBC OFAC," (Fed email - no 
Bates). 

660 See 6/16/2000 email from HSBC Susan Wright to HSBC Matthew King, HSBC OCC 8875191-92. 

661 See 6/28/2001 email from HBEU John Wilkinson to HBUS Denise Reilly and others, "Bank Melli," HSBC OCC 
8876132-133, discussed below. 
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correspondent accounts at HBUS without full disclosure of the transaction details. In some 
instances, the HSBC affiliate simply stripped the identifying Iranian information from the 
transaction documentation. In others, the HSBC affiliate also sent the transaction as a transfer 
between banks in permitted jurisdictions, a tactic sometimes referred to as a "cover payment," 
since the bank-to-bank transfer acted as a cover for the underlying transaction. 662 Both methods 
sought to ensure that a transaction would not be stopped by HBUS' OFAC filter and delayed for 
individualized review to determine whether it, in fact, qualified as a permissible U-turn, but 
would instead benefit from "straight through processing" or STP. 

From 2001 until 2005, the two HSBC affiliates frequently discussed processing Iranian 
U.S. dollar transactions for various Iranian financial institutions and entities through their HBUS 
correspondent accounts. Numerous emails among HBEU, HBME, HBUS, and HSBC Group 
discuss whether HBUS would be willing to process Iranian U-turn transactions and, if so, how. 
At the same time, HSBC Group, HBEU and HBME bankers were pushing to expand contacts 
with Iran. The Senior Payments Manager in HBUS reported being told in a July 2001 
conference call that the HSBC Group, with backing from the Chairman, was seeking to 
"significantly grow our presence in Iran." In 2003, an HBME business proposal estimated 
that processing 700 U.S. dollar payments for Iranian banks per day using U-turn transactions 
would produce income of $4 million, while failing to process them would threaten HSBC's 
current Iranian business which produced annual bank income of $2 million. 664 HBME also 
noted that it already had a "number of existing USD accounts for Iranian banks." 665 

Even though discussions with HBUS over processing the transactions continued in 2002 
and 2003, documentation shows that HBEU had already begun to send U-turn transactions 
through HBUS without disclosing an Iranian connection for many of them. 666 Some HBUE 
compliance and payments personnel objected to altering payment instructions in connection with 
the Iranian transactions, and a key payments official even announced deadlines in January 2004 
and September 2004, after which no Iranian payment instructions would be altered, but both 
deadlines were ignored. HBUS finally approved a protocol to process transparent U-turns in 
December 2004. 667 Even after that protocol was approved, however, HBEU continued to send 
undisclosed U-turn payments through HBUS using cover payments, failing to provide requested 
information to its own affiliate. 

At HBUS, during the same time period, internal documents show that, as early as 2001, 
senior HBUS payments, compliance, and business managers were informed that Iranian U.S. 



The cover method utilizes the MT202 SWIFT message or payment instruction format, which provides a U.S. 
bank with the names of the foreign banks acting as the originator or beneficiary of the immediate transfer, but is not 
required also to provide the underlying origination and beneficiary customer information. 

663 7/12/2001 email from HBUS Denise Reilly to Douglas Stolberg and others, "Bank Melli," HSBC OCC 8876128- 
129. HSBC legal counsel told the Subcommittee that the HSBC affiliates were already doing business with Iran, but 
they wanted to increase that business by doing it with Bank Melli. Subcommittee meeting with HSBC legal counsel 
(6/20/12). 

664 1/2003 memorandum from HBME Rick Pudner to HBUS Denise Reilly and HBEU Malcolm Eastwood and 
others, "Business Case-USD Payment From Iranian Banks/Entities," HSBC OCC 8876490 . 

665 Id. 

666 See, e.g., 12/30/2001 email from Protomastro to Carolyn Wind and others, HSBC OCC 8873909. 

667 Subcommittee interview of Anne Liddy (2/22/2012). 
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dollar payments were being sent by HBEU through HBUS after deleting references to Iran. 
They were also informed of an HBEU proposal to streamline the processing of U-turn 
transactions by omitting references to Iran so the transactions would not be halted by the OF AC 
filter in the United States. Emails at the time show that senior HBUS officials expressed 
discomfort with the HBEU proposal, but took no other action to stop or prevent the activity 
already occurring. 668 In addition, HBUS' OFAC filter occasionally caught an Iranian-related 
transaction, sent by an HSBC affiliate, in which the identifying information had not been fully 
removed, demonstrating that undisclosed U-turns continued to be sent through HBUS 
correspondent accounts, but again, no HBUS personnel took further action to stop the activity. 
In 2003, the Iranian issue was discussed again when a new HBUS AML Director arrived, but 
once more, no decisive action was taken to put a stop to undisclosed U-turns. 

Although HSBC Group Compliance was aware of HBUS' concerns, HBEU's practice of 
stripping information or using cover payments to conceal U-turn transactions involving Iran, and 
the fact that such undisclosed transactions were routinely slipping through HBUS accounts, 
HSBC Group did not prohibit the practice for years. In July 2005, HSBC Group issued a Group- 
wide directive, Group Circular Letter (GCL) 050047, barring all HSBC affiliates from engaging 
in U.S. dollar transactions in violation of OFAC regulations, but continued to allow their use of 
cover payments for permissible U-turn transactions, which meant the transactions would 
continue to circumvent the OFAC filter and individualized review by recipient U.S. banks. In 
April 2006, HSBC Group issued a second Group-wide directive, GCL 060011, requiring HSBC 
affiliates and other financial institutions to use fully transparent payment instructions when 
sending transactions through HBUS accounts, but again allowed U-turns "to be made as cover 
payments." In 2007, HSBC Group decided to exit Iran. 

In recent years, OFAC has sent over a dozen so-called Cautionary Letters to HBUS about 
incidents in which it failed to block a prohibited transaction, including transactions involving 
Iran. In 2010, HSBC Group employed an outside auditor, Deloitte LLP, to identify and review 
OFAC sensitive transactions at HBUS over a seven-year period from 2001 to 2007. That review 
has so far examined 58 million payment messages involving assets of $37 billion that passed 
through the key server, located in the United Kingdom, during that timeframe and identified 
OFAC sensitive U.S. dollar transactions involving assets totaling $19.7 billion. The review 
identified almost 25,000 U.S. dollar transactions involving Iran, involving assets in excess of 
$19.4 billion. 669 The vast majority of the Iranian transactions, ranging from 75% to 90% over 
the years, were sent through HBUS and other U.S. dollar accounts without disclosing any 
connection to Iran. While the affiliates may have viewed these U-turns as permissible under 
U.S. law, the absence of identifying information meant they did not trigger the OFAC filter or an 
individualized review by HBUS to make sure. 



668 7/1 1/2001 email from HBUS Douglas Stolberg to HBUS Denise Reilly, HBUS Joe Harpster, and HBUS Michael 
Gallagher, " Bank Melli," HSBC OCC 8876129. 

669 Deloitte Review of OFAC transactions, "Results of the Transactions Review - UK Gateway, March 29, 2012," 
HSBC-PSI-PROD-0197919 at 930. 
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(b) Concealing Iranian Transactions 

2000 Notice Regarding Iranian Transactions. On June 9, 2000, the HSBC Group 
AML Compliance head Susan Wright learned in an email that a client bank was using deceptive 
practices to send OFAC sensitive U.S. dollar transactions through U.S. correspondent accounts 
while evading detection by the OFAC filter. 

In the June 9, 2000 email to Ms. Wright from an HSBC colleague, she was informed that 
a particular bank, whose name was redacted by HSBC from the email, was "automatically 
replacing a remitter's name with that of the bank. 670 The email stated that the bank planned to 
cease the practice by the end of June, but in the future, for OFAC sensitive transactions, would 
"arrange cover for the payment using MT202/203 remittances." "MT202/203" refers to the 
SWIFT message or payment instructions used to execute bank-to-bank transfers. The email 
explained that bank-to-bank transfers did not require identifying the underlying party who 
originated the transaction or the ultimate beneficiary of the payment. 71 It also indicated that the 
bank planned to send a separate "MT100 message" to the recipient bank providing full payment 
details for the originator and ultimate beneficiary. The email stated: "In this way a payment, in 
US$ can be made for an individual or company on the OFAC list, without the name being 
'detected' by the OFAC filters that all US banks would apply." 672 

Ms. Wright forwarded the June 2000 email to Matthew King, then head of HSBC Group 
Compliance, describing the client bank's past procedure of altering transaction documentation 
when processing OFAC sensitive wire transfers. She wrote: "We advised them that this was 
contrary to SWIFT guidelines (drawn up to address FATF 673 concerns re money laundering via 
wire transfers) which required that the full details (names and addresses) of remitters and 
beneficiaries are included." 674 She also described the client bank's future plan to conceal OFAC 
sensitive transactions behind bank-to-bank transfers. Ms. Wright wrote: "From a Group 
perspective I consider the continuation of this practice to be unacceptable and as a deliberate and 
calculated method to avoid the US OFAC sanctions has the potential to raise serious regulatory 
concerns and embarrass the Group." 

Ms. Wright's reaction indicates that as early as 2000, HSBC Group Compliance learned 
of practices being used to avoid detection by the OFAC filter, and viewed them as 
"unacceptable" and raising potential regulatory concerns that were capable of embarrassing 
HSBC. 



b/u 6/9/2000 email from HSBC Bob Cooper to HSBC Susan Wright, "Significant Exception 2Q00-04," HSBC OCC 
8875192-193. 

671 Id. 

672 6/9/2000 email from HSBC Bob Cooper to HSBC Susan Wright, "Significant Exception 2Q00-04," HSBC OCC 
8875192-193. 

73 FATF is the Financial Action Task Force, the leading international body that set standards for combating money 
laundering and terrorist financing. 

674 6/14/2000 email from HSBC Susan Wright to HSBC Matthew King, "Memo: Significant Exception 2Q00-04," 
HSBC OCC 8875191-192. 
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2001 Bank Melli Proposal. Six months later, in January 2001, HBEU approached 
HBUS with a proposal to use its U.S. dollar correspondent account at HBUS to clear U.S. dollar 
transactions for Bank Melli, the largest commercial retail bank in Iran. 676 At that time, Bank 
Melli' s London Branch maintained a U.S. dollar account with several other major international 
banks, but was interested in establishing a relationship with HSBC that would give the bank the 
majority of Bank Melli' s U.S. dollar clearing business. HBEU conducted an extensive review, 
with advice from two outside U.S. law firms, to determine whether transactions originated by 
Bank Melli would meet the definition of a permissible U-turn transaction under OFAC 
regulations, and concluded that they would, in fact, be permissible. 

Even though the proposed U-turns would be permissible under OFAC regulations, HBEU 
proposed carrying them out in the form of bank-to-bank transfers, without any reference to the 
underlying originator or ultimate beneficiary and, so without any reference to Iran. The aim 
was to ensure that the transactions would not be delayed by triggering an OFAC filter and having 
to undergo individualized review. HBUS compliance personnel responded that any such 
transactions would have to be done in a more transparent manner, with detailed payment 
information specifying the underlying originating and beneficiary customer information. HBUS 
employees expressed concern about using cover payments, since the limited payment 
instructions would not enable HBUS to know whether it was processing a valid U-turn 
transaction involving Iran or whether it was even processing a U-turn transaction at all. 678 It 
would see only two banks making the transfer on the payment instructions and would have no 
knowledge of the underlying customers for whom the transaction was being processed, including 
whether they were prohibited persons. 

Legal Advice. In January 2001, HBUS OFAC Compliance officer Elizabeth 
Protomastro asked outside legal counsel, Tom Crocker, for an opinion as to whether HBUS 
could process U.S. dollar transactions from HBEU on behalf of either Bank Melli or Iran's 
Central Bank, Bank Markazi. 679 After extensive consultations involving two law firms and 
OFAC, HBUS was advised that the Bank Melli transactions could qualify as permissible U-turn 
transactions. 680 



blb HSBC had established a relationship with Bank Melli' s office in Tehran in 1999. 7/1 1/2001 email from HBUS 
Carolyn Wind to HSBC Matthew King and others, "Bank Melli," HSBC-PSI-PROD-0096130-132. 

677 Id. at 0096130. Under international banking practice, it was legal for bank-to-bank transactions to omit 
underlying payment details for the originator and ultimate beneficiary. Subcommittee briefing by OFAC 
(5/8/2012). 

678 Id. at 0096130-131. 

679 See 1/31/2001 email from Elizabeth Protomastro to Tom Crocker, HSBC OCC 8903860. 

680 On February 1, 2001, HBEU provided Ms. Protomastro with more information about the type of U.S. dollar 
transactions that would be sent through HBEU's correspondent account at HBUS, explaining that they would 
include 25 treasury-related payments involving about $750 million per day, 25 treasury-related receipts involving 
about $750 million per day, and 100 commercial payments involving $200 to $300 million per day, none of which 
would be related to letters of credit for military goods. (See 2/1/2001 email from HBEU Peter Blenk to HBUS 
Elizabeth Protomastro, "Central Bank of Iran," HSBC OCC 8903864-865.) On February 2, 2001, Mr. Crocker 
advised that the scenario outlined by HBUE did not appear to qualify for the U-turn exception as stipulated in the 
OFAC Iranian Transactions Regulations, because HBEU could not serve as both the originating and receiving 
foreign bank. (See 2/2/2001 email from Tom Crocker to HBUS Elizabeth Protomastro, "Central Bank of Iran," 
HSBC OCC 8903859-860.) 

In response to Mr. Crocker's opinion, on February 19, 2001, HSBC Group Compliance head Matthew King 
contacted a second law firm, Winthrop Brown, to obtain a second opinion. (See 2/19/2001 email from HSBC 
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HSBC Group Compliance head Matthew King forwarded the legal advice to HBME 
officials Brian Richards and John Richards, stating: "I confirm I am happy for the business to be 
undertaken on this basis." He also wrote: "I am assuming this business will be booked in 
HBEU, hence I am copying Chris Couldrey. If any other Group entity is likely to be involved, 
could you let me know." 681 Brian Richards responded the following day to confirm that payment 
orders from Bank Melli's account would originate from HBEU, and credits in favor of Bank 
Melli would be credited to their account at HBEU. He stated that the payment orders would not 
mention Bank Melli, and HBUS would not receive payment orders or receipts directly from an 
Iranian entity. Mr. Richards concluded that the payment chain would meet the U-turn definition 
provided by Mr. Simons. 

HBEU Payment Instructions. HBEU, HBUS, and HSBC Group Compliance continued 
to discuss HBEU's proposal to process U.S. dollar transactions for Bank Melli. 

In a letter dated April 30, 2001, HBEU's Multicurrency Payments Department (MPD) 
sent Bank Melli a proposal to process their payments with "minimal manual intervention." 683 
The letter included payment templates with specific instructions on how to format U.S. dollar 
transactions so the paperwork would not have to be altered by HBEU. MPD proposed that Bank 
Melli use the provided templates to complete payments fields for both MT202 and MT100 
SWIFT messages 684 and to test the proposal. 6 5 In the letter, MPD Business Development 
Manager John Fowle advised the Bank Melli Cash and Payments Manager in London, Saeed 
Pourjam: 

"[F]ollowing tests in our payments environment we are confident that we have found a 
solution to processing your payments with minimal manual intervention. The key is to 



Matthew King to Winthrop Brown and HBME John Richards, "Memo: OFAC constraints in the Central Bank of 
Iran operating a USD Clearing account with HSBC Bank pic in London," HSBC OCC 8903876-877.) One of the 
firm's lawyers, John Simons, consulted with OFAC and obtained a copy of the payment processing procedure for 
qualified "U-Turn Dollar Clearing" transactions. He explained he was waiting to confirm with OFAC's Chief 
Counsel Office about whether a second U.S. bank was required to process permissible U-turn transactions. The 
email indicated that they had also determined that a requirement in Section 560.516 (b) for U.S. depository 
institutions to determine if an underlying transaction was prohibited by OFAC, "prior to initiating a payment on 
behalf of any customer or crediting a transfer to the account on its books of the ultimate beneficiary," did not apply 
to U-turns. (See 2/2001 email from John Simons to Winthrop Brown, "Memo: OFAC constraints in the Central 
Bank of Iran operating a USD Clearing account with HSBC Bank pic in London," HSBC OCC 8903875-876.) 

In April 2001, Mr. Simons emailed Mr. King that OFAC had confirmed that a second U.S. bank was not 
required when processing permissible U-turn transactions and no specific OFAC license was required to engage in 
U-turn transactions. (See 4/26/2001 email from John Simons to HSBC Matthew King and others, OFAC - Iran," 
HSBC OCC 8903868-870. 

681 4/26/2001 email from HSBC Matthew King to HBME Brian Richards and others, "OFAC - Iran," HSBC OCC 
8903868. 

682 4/27/2001 email from HBME Brian Richards to HSBC Matthew King and others, "OFAC - Iran," HSBC OCC 
8903874. 

683 See 7/1 1/2001 email from HBUS Carolyn Wind to HSBC Matthew King and others, "Bank Melli," HSBC OCC 
8876130-136 at 135-136 (including a copy of the April letter). 

684 MT202 and MT100 are examples of SWIFT messages used by financial institutions to facilitate payment 
processing. Different messages utilize specialized formats, dependent on the type of transaction, to process the 
payments. Subcommittee briefing by OFAC (5/8/2012); Subcommittee briefing by Deloitte (5/51/2012). 

685 7/1 1/2001 email from HBUS Carolyn Wind to HSBC Matthew King, "Bank Melli" HSBC OCC 8876130-136 at 
133-136. 
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always populate field 52 - if you do not have an ordering party name then quote "One of 
our Clients", never leave blank. This means that the outgoing payment instruction from 
HSBC will not quote "Bank Melli" as sender - just HSBC London and whatever is in 
Field 52. This then negates the need to quote "DO NOT MENTION OUR NAME IN 
NEW YORK" in field 72." 686 



This email shows HBEU designed a payment method to avoid the OFAC filter by preventing the 
inclusion of information about the participation of the Iranian bank. The method developed by 
HBEU ensured that no language that would normally trigger an OFAC review - such as "do not 
mention our name in New York" - appeared in the transaction documentation. 

On May 25, 2001, in an email to colleagues, Michael Gallagher, an HBUS senior official 
at the Payments and Cash Management (PCM) division, expressed discomfort with the Bank 
Melli proposal to colleagues, including his supervisor, Douglas Stolberg, head of Commercial 
and Institutional Banking (CIB): "I wish to be on the record as not comfortable with this piece 
of business." 7 His statement did not elicit any immediate response. When interviewed, Mr. 
Gallagher told the Subcommittee that he sent this email to express his concerns to his colleagues, 
including his supervisor, and then left it to them to determine what should be done. 688 

In the meantime, HBEU had already begun processing Bank Melli U-turns through its 
account at HBUS, using cover payments so that the transactions would not trigger HBUS' OFAC 
filter. This fact was disclosed in a June 28, 2001 email from the HBEU Institutional Banking 
Relationship Manager who handled the Bank Melli account, John Wilkinson. 689 In the email, he 
was discussing the Bank Melli proposal with the head of HBUS' payment services, Denise 
Reilly. Mr. Wilkinson explained that once the proposal "goes live," Bank Melli was instructed 
"to alter the format" of their payments to achieve straight through processing. Mr. Wilkinson 
wrote: 



"[W]e have further asked them to only put 'One of our clients' in field 52, thus removing 
the chance of them inputting an 'Iranian referenced' customer name, that causes fall out 
of the cover payment sent to HBUS and a breach of OFAC regulations." 690 

He also explained that using 'One of our clients' in field 52 "is a standard phrase used by MPD 
[HBEU's Multicurrency Payments Department] in these situations." 691 Acknowledging Ms. 



Id. at 8876135 (emphasis in original). Two months earlier, on May 21, 2001, HBEU Institutional Banking (CIB 
IBL) conducted a call with Bank Melli to inquire about the names of the principal beneficiaries of their payments. 
The resultant call report indicated that "as expected," Bank Melli was unable to answer with the reasoning that Iran 
imports from many countries and suppliers worldwide. This information had been previously requested by a Senior 
Manager in Payment Operations at HBUS, Denise Reilly. An Area Manager within HBEU CIB IBL, Brian 
Richards, forwarded the response to Ms. Reilly the following day. Ms. Reilly then forwarded Mr. Richard's email 
to HBUS Compliance personnel. 5/22/2001 email from HBUS Denise Reilly to HBUS Carolyn Wind and others, 
"Bank Melli," HSBC-PSI-PROD-0096138-142. 

687 5/25/2001 email from HBUS Michael Gallagher to HBUS Denise Reilly and Douglas Stolberg, "BANK 
MELLI," HSBC-PSI-PROD-0096138. 

688 Subcommittee interview of Michael Gallagher (6/13/2012). 

689 6/28/2001 email from HBEU John Wilkinson to HBUS Denise Reilly and others, "Bank Melli," HSBC OCC 
8876132-133 at 133. 
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Reilly's concerns following "a recent formatting error" detailed in an earlier email of June 15, 
2001, Mr. Wilkinson noted that Bank Melli had not yet begun to use the new formatting method 
detailed in the April letter: 

"Bank Melli are still formatting payments in their usual method, in this instance MPD 
failed to spot the poor input and did not follow their normal procedure of altering the 
payment, hence it was blocked. MPD have again confirmed the new formatting method 
will achieve straight through processing and overcome these difficulties." 692 

Mr. Wilkinson's email shows that Bank Melli was already processing undisclosed U-turn 
transactions through HBEU's account at HBUS, using what he calls "their usual method" for 
formatting the payments, prior to the proposed changes. His email also described HBEU's 
"normal procedure" as "altering" Bank Melli' s payments to prevent the payments from being 
blocked. The proposed new procedure was aimed at eliminating those manual interventions on 
the part of HBEU to both expedite payments, potentially saving time and therefore money. 

This June 2001 email put HBUS on notice that HBEU had at times altered transactions 
involving Bank Melli in Iran, a practice already so commonplace at HBEU it was called its 
"normal procedure." This email was sent to the head of HBUS' payment service operations, 
who then alerted other HBUS executives. When asked about this document describing the 
alteration of documents being engaged in by an HSBC affiliate, senior HBUS Compliance 
official Anne Liddy, who oversaw HBUS' OFAC compliance program, told the Subcommittee 
that it would have been a problem if U-turns were being processed in 2001, since HBUS did not 
then have a process in place to conduct U-turns appropriately. 693 

HBUS Objections. On July 1 1, 2001, after HBUS Compliance head Carolyn Wind 
learned of the HBEU proposal, she sent an email to HSBC Group Compliance head Matthew 
King objecting to it. 694 What followed was a growing consensus that HSBC should not be 
pursuing its business in this fashion. Ms. Wind included the Wilkinson email from June and a 
copy of the April letter sent to Bank Melli providing payment message instructions. Ms. Wind 
expressed several concerns, including whether the transactions sent via the cover payments 
would be permissible under OFAC regulations and that "HBUS will not be able to confirm 
whether or not the underlying transaction actually meets the 'U-Turn' requirement." She noted 
further that it was "not apparent that HBEU will be able to confirm that each payment meets the 
requirements." She wrote: 

"In an effort to facilitate 'straight-through processing', it now appears that HBEU will 
train Bank Melli on formatting the payments and that we will be relying on Bank Melli to 
ensure that only qualifying payments are processed through HBEU's account with 
HBUS." 695 



692 w! 

693 Subcommittee interview of Anne Liddy (2/22/2012). 

694 7/1 1/2001 email from HBUS Carolyn Wind to HSBC Matthew King and others, "Bank Melli," HSBC OCC 
8876130-136. 

695 Id. at 8876130. 
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Ms. Wind also expressed concern about how it might appear to U.S. regulators that HBEU 
trained Bank Melli to write payment instructions in such a way, pointing out that if OFAC were 
to identify a transaction that did not qualify as a permissible U-turn, OFAC might consider 
"HSBC's actions due to the non-disclosure as having involved willful disregard or evasion." 696 

HBUS payment services head Denise Reilly forwarded Ms. Wind's email to Douglas 
Stolberg, head of HBUS Commercial and Institutional Banking (CIB). He responded: "With the 
amount of smoke coming off of this gun, remind me again why we think we should be 
supporting this business?" 697 

Ms. Reilly responded by sending Mr. Stolberg a memorandum prepared by the HSBC 
Group Representative for Iran, John Richards, which stated that HSBC Group "with the backing 
of Bond" - referring to the HSBC Chairman of the Board of Directors - wanted to "significantly 
grow our presence in Iran" with current lines of credit reported to be $800 million, trade lines of 
$150 million, and growth anticipated in trade, cash management and internet banking. The 
memorandum indicated that HSBC Group and HBEU wanted to expand the bank's presence in 
Iran and viewed clearing U.S. dollar transactions for Bank Melli as a profitable venture that 
could help win additional business in Iran, despite U.S. sanctions and HBUS concerns. 698 

These email exchanges show that, by July 2001, senior HBUS compliance, payments, 
and business managers, as well as the HSBC Group Compliance head, were aware that Iranian 
U.S. dollar transaction documentation was being altered by HBEU and the transactions were 
being processed through HBUS. 699 HBUS Compliance head Carolyn Wind complained to 
HSBC Group Compliance head Matthew King, but neither stopped the practice, nor did HSBC 
Group obtain a legal opinion about whether its U.S. dollar cover payments were in compliance 
with OFAC regulations. 

HBUS' Payments Proposal. In August 2001, HBUS offered its own proposed 
procedures to clear U.S. dollar transactions involving Bank Melli. 700 Uncomfortable with the 
formatting solution proposed by HBEU a few months prior, HBUS proposed that Bank Melli be 
listed as the originator in the payment instructions and proposed establishing a segregated 
account for the transactions so HBUS could ensure that all Bank Melli payments would be 
stopped by the OFAC filter for further review and approval. 



696 Id. at 8876131. 

697 See 7/11/2001 email exchanges among HBUS Douglas Stolberg and HBUS Denise Reilly, Joe Harpster, and 
Michael Gallagher, "Bank Melli," HSBC OCC 8876128-130. 

698 Id. at 8876128-129. 

699 7/1 1/2001 email exchange among HBUS Carolyn Wind, HBUS, Paul Lee, HBUS Anne Liddy, HBUS Douglas 
Stolberg, HBUS Michael Gallagher, and HBUS Denise Reilly, HSBC OCC 8876129. 

700 The procedures consisted of a two-step debit process and a five-step OFAC review process, and committed to 
same day processing for transactions determined to be U-turn compliant. The procedures required that Bank Melli 
transactions be segregated in an "HBEU Special Account" with the account number entered into the OFAC filter so 
that every Bank Melli transaction would be stopped in the OFAC queue for two reviews and two approvals prior to 
processing. Bank Melli would appear as the originator for all related transactions. 8/29/2001 email from HBUS 
Denise Reilly to HBAP Alan Wilkinson and others, "Bank Melli," HSBC OCC 7687346-348. 
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On August 30, 2001, HSBC's John Richards expressed his support for the procedures, 
noting it would be the first time that an Iranian bank name was mentioned in the payment 

701 

message. 

On September 6, 2001, HBUS met with the Director of the Office of Foreign Assets 
Control (OFAC) to discuss clearing Bank Melli U-turn transactions. Carolyn Wind commented 
that although OFAC did not approve or reject the proposal, she walked away from the meeting 
thinking that OFAC was "okay with it."™ 2 

HBME's Iranian Transactions. While HBEU was processing U-turn transactions for 
Bank Melli, a second HSBC affiliate, HSBC Middle East (HBME), was also carrying out OFAC 
sensitive transactions for other clients, using its own and HBEU's U.S. dollar correspondent 
accounts at HBUS apparently without alerting HBUS to the transactions. In an October 2001 
email, David Bagley, then HBME Regional Head of Legal and Compliance, sought guidance 
from HSBC Group Compliance head Matthew King about how OFAC sensitive transactions 

703 

should be handled. Mr. Bagley wrote: "As I understand the current position we do routinely, 
and across the Group, adopt differing approaches to payments potentially subject to OFAC 
sanctions." Mr. Bagley wrote that, at HBME, payments were not structured "against a specific 
request from the customer, rather we undertake this structuring as a routine," and that he was not 
clear about whether those procedures were viewed "as being inappropriate, and thus should be 
disallowed." He also noted: "I am advised that there may even be software in the UK which 
filters such payments for restructuring in the event that the original message has been structured 
in such a way that it will be caught by the OFAC filters." 

Mr. Bagley cautioned that subjecting all OFAC sensitive payments to the OFAC filter for 
further review and approval would likely hurt business. He wrote: "disallowing all payments 
which are potentially subject to the OFAC process," or the alternative of forwarding "messages 
in such a way that they would be caught," would have a "significant affect" upon HBME's 
business within the Middle East and the Group's business within correspondent banking. He 
also wrote: "given the likely volumes it is impractical to submit each payment to a process of 
referral to HBUS," as HBUS had proposed. He concluded with a request for clear guidance: "I 
would be grateful for your clarification as to whether what is currently going on is acceptable, or 
whether we should be adopting a different practice." 704 

Mr. King responded that the September 11, 2001 terrorist attack on the United States 
required a reassessment. He wrote: "some of the routes traditionally used to avoid the impact of 
US OFAC sanctions may no longer be acceptable." Mr. King indicated that an automated 
screening system was being looked into, and in the interim asked that OFAC sensitive payments 
be vetted manually. 705 



701 8/30/2001 email from HSBC John Richards to HBUS Denise Reilly and others, "Bank Melli," HSBC-PSI- 
PROD-0096147-48. 

702 Subcommittee interview of Carolyn Wind (3/7/2012). 

703 10/10/2001 email exchange among HSBC Matthew King and HBME David Bagley and others, "OFAC 
Sanctions," HSBC OCC 8873890-893 at 892. 

704 Id. at 8873892. 

705 Id. at 8873890. 
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Mr. Bagley's email alerted Mr. King to the fact that HBME, like HBEU, was routinely 
sending U.S. dollar transactions through its correspondent account at HBUS using methods 
intended to circumvent HBUS' OFAC filter. His email did not limit those transactions to Iranian 
U-turns, but sought broader guidance on acceptable practice. Mr. King wrote back: "all we can 
do is ask that payment from the affected countries are vetted manually." 

(c) Pressuring HBUS on Iran 

In April 2002, HBME asked HBUS to re-circulate its proposed procedures for processing 

707 

Iranian U-turn transactions, indicating that the two affiliates were still attempting to reach 
agreement on the procedures to be used. 708 

HBEU Draft Guidelines. While the HBEU Relationship Manager for Institutional 
Banking in HBME, John Wilkinson, was trying to streamline the cover payments procedure used 
to send Iranian U-turns through HBEU's correspondent account at HBUS, HBEU Compliance 
was trying at the same time to put a stop to the practice altogether. On July 15, 2002, an HBEU 
Compliance officer forwarded draft guidelines for handling OFAC sensitive transactions to 
HBEU Compliance manager Julie Clarke and HBEU Multicurrency Payments Department 
(MPD) head Malcolm Eastwood and requested their approval. 709 The proposed guidelines stated 
in part that, although HBEU was not legally required to comply with U.S. OFAC prohibitions, 
"It is strongly recommended . . . that RMs [Relationship Managers] do not deliberately take 
action aimed at assisting a customer to circumvent OFAC sanctions. For example payment 
instructions should not be amended by IBL staff." The proposed guidance also stated: "On no 
account should you deliberately guide, encourage or coerce the sender into amending the 
payment details so as to circumvent the OFAC sanctions. . . . We will simply process as 

710 

instructed." The draft guidance relied on the following Group Policy: 

"Group members should comply with both the letter and spirit of all relevant laws, codes, 
rules, regulations and standards of good market practice in each jurisdiction around the 
world where they conduct business." 711 



/u& Id. at 8873890-891. 

707 4/15/2002 email from HBUS Denise Reilly to HBEU John Wilkinson and others, "Bank Melli," HSBC OCC 
7687376-377. 

708 According to Mr. Bagley, the HBEU Payment Services' December 2002 Compliance Certificate made explicit 
reference to its practice of altering Iranian U.S. dollar payments. Subcommittee interview of David Bagley 
(4/12/2012). Compliance Certificates from affiliates are normally consolidated and sent to HSBC Group 
Compliance for review, which would have provided a formal channel for addressing the issue. David Bagley told 
the Subcommittee, however, that the reference to U-turn transactions in HBEU's 2002 certificate was not 
incorporated into the consolidated Compliance Certificate and therefore was not formally escalated to Group 
Compliance for review. Id. 

709 7/15/2002 email from HBEU Paul Proctor to HBEU Julie Clarke, HBEU Malcolm Eastwood, and others, 
"Monitoring of payment transactions against sanctions," HSBC OCC 8877103-106. 

710 Id. at 8877106. 

711 Id. at 8877105. The guidelines also noted that the responsibility for "policing payment and cheque clearings 
against sanctions" would move to Payment Services in the future. 
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These guidelines were later approved and became effective in the fall of 2003. They show 
that HBEU Compliance and business personnel were aware of and concerned about potentially 
deceptive practices some could use to circumvent OFAC prohibitions. 

HEME Negotiations. While HBEU Compliance developed the OFAC guidelines, Gary 
Boon, HBME Payment and Cash Management (PCM) sales manager in Dubai, spent the second 
half of 2002, making a concerted effort to reach agreement with HBUS on how to process U-turn 
transactions. On August 29, 2002, Mr. Boon emailed Denise Reilly and Nancy Hedges in HBUS 
Payment Operations, to encourage HBUS to officially approve the processing of U-turn 
transactions involving Iranian banks. He wrote: "I can now confirm that HSBC Bank pic, 
London does not have any processing or compliance issues in respect of USD payments from 
existing or new opportunities with Iranian Banks." 713 He also wrote that HBEU wanted "to 
ensure the payments are STP [straight through processing]," and HBEU would provide its clients 
with guidelines for formatting transactions to "ensure that our Iranian clients fully understand, 

714 

when or how, payments could be rejected." He indicated that he was seeking HBUS' formal 
agreement to process the U-turn transactions, from both a resource and reputational risk 

TIC 

standpoint, "before I attempt to sell a USD clearing proposition." 

On October 8, 2002, Mr. Boon sent an email to senior HBUS Compliance official, Anne 
Liddy, seeking feedback on the HBEU proposal. 716 Ms. Liddy responded that the position of 
HBUS Compliance remained unchanged "in that all transactions involving Bank Melli must be 
fully disclosed and represented in one single transaction that reflects the complete flow of 

717 

funds." Ms. Liddy noted that the HBUS proposed procedures had been approved by Legal 
Counsel as meeting OFAC requirements. She also stated that HBUS and HBEU needed to reach 
agreement on the payment procedures before HBUS Compliance would present an official 
proposal to HBUS' Senior Management Committee or OFAC for approval. Ms. Liddy was also 
clear that these steps had to be taken prior to HBEU's making any proposal to Bank Melli or 
another Iranian bank. 

Mr. Boon responded on the same day that HBEU would soon be complying with the 
Financial Action Task Force (FATF) regulations requiring full disclosure of payment details on 
MT100/MT103 message formats, which was already part of the HBEU proposal since HBEU 
sent those messages to the bank receiving a U-turn payment in addition to sending a cover 
payment on a MT202 form. He indicated that the payments sent to HBUS fall into the category 
of permissible U-turn transactions, and noted that HBUS was already processing U.S. dollar 
transactions through two existing accounts in London. 719 Mr. Boon wrote: "The majority of 



712 See 9/8/2003 email from HBEU Julie Clarke to HBEU Paul Proctor and others, "OFAC sanctions evasion - 
Iranian payments," HSBC OCC 8876819-820. 

713 8/29/2002 email from HBME Gary Boon to HBUS Nancy Hedges, HBUS Denise Reilly, and others, "IRAN- 
USD PAYMENTS," HSBC OCC 0948193-195. 

714 Id. at 0948194. 

715 Id. at 0948194. 

716 See 10/08/2002 email exchanges among HBUS Anne Liddy, HBME Gary Boon, and others, "Bank Melli," 
HSBC OCC 7687374-375. 

717 Id. at 7687375. 

718 Id. at 7687375. 

719 Id. at 7687374-375. 
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payments will be processed with HBEU sending a MT100/MT103 to the beneficiary bank and 

720 

HBUS will receive the MT202 cover payment (again your already doing this)." He indicated 
that, due to "massive opportunities," he would like to resolve the procedural issues prior to a 
scheduled visit to Iran in November 2002. 721 In response, Ms. Liddy reluctantly set up a 

799 

conference call with Mr. Boon and included Carolyn Wind and Denise Reilly. 

When asked about this email, Ms. Liddy told the Subcommittee that she misinterpreted 
Mr. Boon's assertion that HBUS was already processing Iranian payments through existing 
accounts in London to mean that the issue affected London accounts, but not accounts in the 

79^ 

United States. She said that she became more concerned two months later, in December 2002, 

794 

when a Bank Melli payment was caught in HBUS' OFAC filter. Carolyn Wind told the 
Subcommittee that she was surprised by Mr. Boon's email and didn't know what his comments 
meant. Ms. Wind said that she contacted HSBC Group Compliance head Matthew King to 

79S 

follow-up, but didn't know what action he took, if any. 

The results of the conference call between HBME and HBUS were discussed in email 
correspondence later that month. On October 28, 2002, Mr. Boon wrote to Denise Reilly 
requesting an update. Ms. Reilly responded that HBUS had spoken with OFAC; the 
"MT100/MT103 and MT202 normal cover payment process has been deemed unacceptable"; 
and OFAC required "full disclosure of the transaction." 726 Mr. Boon and Ms. Reilly then agreed 
that HBEU should open a separate "Special nostro account" for all U-turn transactions to ensure 
each transaction would be caught by the OFAC filter for review and approval. 727 Mr. Boon 
requested confirmation that if HBEU met those terms and the HBUS committee approved the 
proposal, that "HBUS would be in a position to potentially become Iran's USD Clearing Agent, 

728 

HBEU would be their USD Correspondent Bank?" Ms. Reilly responded that the current 
proposal was to "process transactions on behalf of Bank Melli" and if the proposal were broader 
"then it should be included in the business rationale that we requested in our conference call 

79Q 

earlier this week for presentation to HBUS senior management." She indicated that the HBUS 
Senior Management Committee was comprised of the President of the bank, key business heads, 
and the head of key support units. While these emails suggest HBUS Compliance was poised to 
present the Iranian U-turn proposal to the HBUS Senior Management Committee, there is no 
indication in the documentation that the committee ever received or approved it. 

Eastwood Memorandum. In November 2002, HBEU Multicurrency Payments 
Department (MPD) head Malcolm Eastwood sent a memorandum to HBUS Payments Services 



720 Id. at 7687375. 

721 10/17/2002 email from Gary Boon to Anne Liddy, "IRAN," HSBC OCC 7687373. 

722 10/21/2002 email from Anne Liddy to Carolyn Wind and Denise Reilly, "IRAN," HSBC OCC 7687373. 

723 Subcommittee interview of Anne Liddy (2/22/2012). 

724 Id. See also 12/30/2002 email exchanges among HBUS Elizabeth Protomastro, HBUS Carolyn Wind, HBUS 
Anne Liddy, HBUS Denise Reilly, and HSBC David Bagley, "OFAC: PLC wire on behalf of Melli Bank PLC," 
HSBC OCC 8873909. 

725 Subcommittee interview of Carolyn Wind (3/07/2012). 

726 10/29/2002 email from HBUS Denise Reilly to HBME Gary Boon and HBUS Nancy Hedges, " IRAN-USD 
Payments," HSBC OCC 0948192-193. 

727 Id. at 0948192. 

728 Id. at 0948192. 

729 Id. at 0948192. 
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head Denise Reilly and Geoff Armstrong expressing concern that HSBC was exposing itself to 
unnecessary risk by handling OFAC sensitive payments. 730 He wrote: 

"I currently feel that we may be exposing ourselves to unnecessary and unacceptable 
Reputational and Operational Risk when we are handling payments originating from FIs 
[financial institutions] domiciled in or who are a local branch of an FI domiciled in an 
OFAC regulated country." 

Mr. Eastwood stated that HBEU's current process was to send OFAC sensitive payments to 
HBUS via the "cover" payment method that made no mention of Iran or other prohibited 

73 1 

countries. He noted that two payments, one from Iran and one from Cuba, had recently been 
caught by HBUS's OFAC filter. Mr. Eastwood stated that he wanted to resolve the situation, 
and "we therefore need to seek clarification of HBUS/OFAC's stance so that we can determine 
our future payments strategy." 

The Eastwood memorandum again put HBUS on notice regarding HBEU's practice of 
concealing U-turn transactions behind cover payments and altering the payment instructions 
received from Iranian banks. Mr. Eastwood wrote: "The Iranian banks continue to send us what 
I describe as conditional payment instructions which for HBEU require an element of 
amendment by ourselves." 733 Mr. Eastwood warned: "If we cannot achieve this [a resolution on 
how to handle U-turn transactions] I will have to recommend to my General Manager a view that 
processing these payments is 'unsafe' and that these items should be filtered out and cancelled. 

H'lA 

This would have severe repercussions for our Group relationship within the Iranian FIs." 

That same day, HBUS Payments Services head Denise Reilly forwarded the Eastwood 
memorandum to HBUS PCM head Michael Gallagher and HBUS Compliance head Carolyn 
Wind, with the note: "We need to discuss." HBUS records do not indicate whether that 
discussion took place. When asked about this email, Mr. Gallagher told the Subcommittee that 
he wasn't sure he received Mr. Eastwood's memorandum because he wasn't named on it. 
When shown another email indicating he had discussed the Eastwood memorandum again in 
December 2003, with the new HBUS AML head, 737 he told the Subcommittee that he did not 

738 

recall the memorandum, any discussion of it, or taking any action in response to it. When 
Carolyn Wind was asked about the Eastwood memorandum, she told the Subcommittee that 
HBUS kept "pushing back on U-turns." 739 



"° 1 1/14/2002 memorandum from HBEU Malcolm Eastwood to HBUS Denise Reilly and HBEU Geoff 
Armstrong, "Compliance - OFAC Issues in General and Specific to Iran," HSBC OCC 7688824. 

731 Id. at 7688825. 

732 Id. at 7688825. 

733 Id. at 7688826. 

734 Id. at 7688826. 

735 1 1/14/2002 email from HBUS Denise Reilly to HBUS Carolyn Wind and HBUS Michael Gallagher, 
"Compliance - OFAC Issues in General and Specific to Iran," HSBC OCC 7688822-827. 

736 Subcommittee interview of Michael Gallagher (6/13/2012). 

737 See 12/17/2003 email from HBUS Denise Reilly to HBUS Teresa Pesce, "Compliance - OFAC Issues in General 
and Specific to Iran," HSBC OCC 3407517-522 ("Attached is the memo that we discussed yesterday in our meeting 
with Michael Gallagher."). 

738 Subcommittee interview of Michael Gallagher (6/13/2012). 

739 Subcommittee interview of Carolyn Wind (3/7/2012). 
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Do Not Mention Our Name. In late December 2002, HBUS OFAC Compliance officer 
Elizabeth Protomastro notified Carolyn Wind, Denise Reilly, and Anne Liddy that, on December 
27, 2002, the HBUS OFAC filter had stopped and rejected a payment listing Bank Melli as the 
originator of the payment and containing a field that read, "Do not mention our name in NY." 
Ms. Protomastro advised rejecting all U-turn transactions containing such language. The 
language on the stopped transaction shows how information related to Iranian payments was 
intentionally withheld from HBUS. In response, Ms. Liddy went to Carolyn Wind's office and 
spoke with her, Denise Reilly, and Paul Lee, HBUS' Legal Counsel, about the transaction. She 
was told to alert David Bagley, who had become head of HSBC Group Compliance in January 
2002. 740 That same day, Anne Liddy forwarded Ms. Protomastro's email to Mr. Bagley. 741 Ms. 
Liddy told the Subcommittee that she was concerned about the Bank Melli payment, because 
HBEU still had not obtained approval to do those types of transactions. She told the 
Subcommittee that neither Mr. Bagley nor Ms. Wind provided any feedback on the incident, and 
she didn't know what action, if any, Mr. Bagley took. 743 

The 2002 Eastwood memorandum again put senior HBUS compliance and business 
officials on notice that HBEU was sending undisclosed OFAC sensitive transactions through its 
U.S. dollar correspondent accounts at HBUS. Again, HBUS officials alerted their superiors, but 
no further action was taken. 

(d) Continuing Pressure on HBUS to Process Iranian Transactions 

Although HBEU handled the Bank Melli account, it was HSBC Middle East (HBME) 
that was at the center of efforts to pressure HBUS to process Iranian transactions without 
triggering the OFAC filter. HBME took the lead in dealing with Iran and selling bank services to 
Iranian banks. In January 2003, HBME Group Relationship Manager for the Middle East, Nigel 
Weir, sent HBUS Payments Services head Denise Reilly and HBEU MPD head Malcolm 
Eastwood a memorandum entitled, "Business Case-USD Payments from Iranian 
Banks/Entities." 744 This HBME memorandum laid out the "business case" for HBUS' 



Subcommittee interview of Anne Liddy (2/22/2012). Mr. Bagley assumed the duties of HSBC Group 
Compliance head in January 2002, but his appointment did not become official until Mary 2002, after the U.K. 
Financial Services Authority approved it. Subcommittee interview of David Bagley (5/10/2012); Subcommittee 
briefing by Cahill Gordon & Reindel LLP (6/20/2012). 

741 See 12/30/2002 email exchanges among HBUS Elizabeth Protomastro, HBUS Carolyn Wind, HBUS Anne 
Liddy, HBUS Denise Reilly, and HSBC David Bagley, "OFAC: PLC wire on behalf of Melli Bank PLC," HSBC 
OCC 8873909. 

742 Subcommittee interview of Anne Liddy (2/22/2012). 

743 Id. See also at 12/30/2002 email exchanges among HBUS Elizabeth Protomastro, HBUS Carolyn Wind, HBUS 
Anne Liddy, HBUS Denise Reilly, and HSBC David Bagley, "OFAC: PLC wire on behalf of Melli Bank PLC," 
HSBC OCC 8873909. 

744 1/2003 memo from HBME Rick Pudner to HBUS Denise Reilly and HBEU Malcolm Eastwood and others, 
"Business Case-USD Payments From Iranian Banks/Entities," HSBC OCC 8876490; 1/21/2003 email exchanges 
among HBUS Anne Liddy, HBUS Carolyn Wind, HBUS Denise Reilly and others, HSBC OCC 3407510. Nigel 
Weir and Rick Pudner were joint authors of the memorandum. 
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processing Iranian transactions using the procedures proposed by HBEU back in August 2001. 745 
The memorandum stated: 

"Currently, it is estimated that Iranian banks issue up to 700 USD payments a day using 
their USD service providers, mainly banks in the UK and Europe, which in turn use their 
New York USD correspondents to effect the payments. It is believed that some service 
providers amend the payments to ensure Iran is not mentioned in the body of the payment 
instruction to their USD correspondent. This process minimizes the risk of payment 
being referred to OFAC." 746 

The memorandum did not state explicitly that both HBME and HBEU were already engaged in 
the same practice using their U.S. dollar accounts at HBUS. 

The HBME memorandum stated that HBME "believe[s] there is a substantial income 
opportunity to see a USD payments proposition to Iranian Banks," and provided an appendix 
detailing existing and potential business opportunities in Iran, while noting HBEU already had a 
"number of existing USD accounts for Iranian banks, which are used for payments clearing 
purposes." 747 The memorandum concluded: 

"It is anticipated that Iran will become a source of increasing income for the group going 
forward and if we are to achieve this goal we must adopt a positive stance when 
encountering difficulties. We are aware of the concerns expressed by HBUS but strongly 
believe that by working together we can overcome them using means which are perfectly 
legitimate and in accordance with rules laid down by the relevant regulatory bodies. I 
hope we will be able to resolve this issue otherwise I fear we will destroy future value in 
a market which has substantial potential for the group." 748 

HBME asked that the business case be presented to HBUS' Senior Management Committee at 
the earliest opportunity. 

On January 16, 2003, Denise Reilly forwarded the HBME memorandum to HBUS 
Compliance officials Carolyn Wind and Anne Liddy. 749 On January 21, 2003, Ms. Liddy 

750 

forwarded it to Tom Crocker, the outside legal counsel advising HBUS on OFAC matters. 



745 Id. at 1. The memorandum stated: "This paper has been produced in order for the Senior Management 
Committee (SMC) of HSBC Bank USA (HBUS) to evaluate whether or not HBUS will process US dollar (USD) 
payments initiated by Iranian Banks via accounts held with HSBC Bank Pic (HBEU)." Id. 

746 Id. at 8876490. 

747 Id. at 8876493. Internal bank documents indicate that HBEU cleared U.S. dollar transactions through its 
correspondent account at HBUS for at least six Iranian banks, Bank Melli, Bank Kesharvazi , Bank Markazi, Bank 
Sepah, Bank Tejarat, and the Export Development Bank of Iran. See, e.g., 10/23/2003 email from HSBC John Root 
to HSBC David Bagley and others, "USD Clearing - Iranian Banks," HSBC OCC 8875217. HBEU senior 
payments official Rod Moxley told the Subcommittee that he believed seven or eight Iranian banks used HSBC for 
U.S. dollar correspondent services. Subcommittee interview of Rod Moxley (6/07/2012). 

748 1/2003 memo from HBME Rick Pudner to HBUS Denise Reilly and HBEU Malcolm Eastwood and others, 
"Business Case-USD Payments From Iranian Banks/Entities," HSBC OCC 8876492. 

749 Subcommittee interview of Anne Liddy (2/22/2012). 

750 See 1/21/2003 email from HBUS Anne Liddy to External Counsel Tom Crocker and others, "USD Payments 
from Iranian Banks," HSBC OCC 3407510-11. 
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When asked about the memorandum, Ms. Liddy told the Subcommittee she did not recall it or 

751 

the outcome of Mr. Crocker's review. 



On February 3, 2003, HSBC Group Compliance head David Bagley sent an email to 
HBME, where he used to work, discussing the issue. He conveyed that he had asked senior 
Compliance official John Root to review the OFAC issue from a Group perspective. He also 
wrote that he "would be grateful if we could exercise greater care with regard to the content of 
written material" being sent to HBUS, explaining: "The business case includes a number of 
express references to practices which may constitute a breach of US sanctions, including the 
OFAC provisions, and could provide the basis for action against the HSBC Group for breach of 

753 

those sanctions, or seeking to facilitate a breach." Mr. Bagley requested that future 
communications regarding this subject be cleared through him or John Root "to avoid relative 
sensitive references," prior to involving HBUS. 754 The recipient of the email, Nigel Weir, 
responded that the memorandum was intended to recommend pursuing a significant business 

755 

opportunity, while complying with applicable regulations. Mr. Bagley told the Subcommittee 
that this was the first time, in his role as head of HSBC Group Compliance, he addressed the 
OFAC issue. He noted that HBME's actions could potentially "constitute a breach of US 
sanctions," yet it would take him two more years, until July 2005, to establish Group policy 
prohibiting such conduct. 

Again, there was no indication that a proposal for handling Iranian U-turn transactions 
was ever presented to or approved by HBUS' Senior Management Committee. At the same 
time, undisclosed transactions continued to be sent by HSBC affiliates through their 
correspondent accounts at HBUS. A later analysis performed by an outside auditor at HBUS' 
request found that, in 2002 alone, HBEU sent at least 1,900 and HBME sent at least 400 Iranian 
transactions through U.S. dollar accounts in the United States. 

Caught in the OFAC Filter. On June 13, 2003, another Bank Melli transaction was 
caught in the HBUS OFAC filter, containing not only a reference to the bank, but also the words 
"do not mention our name." 757 On June 16, 2003, HBUS OFAC Compliance officer Elizabeth 
Protomastro alerted both Carolyn Wind and Anne Liddy. Ms. Wind forwarded the email to 
HSBC Group Compliance officer John Root, and Ms. Protomastro provided him with additional 
details about the payment, including that it involved $150,000. She explained that when the 
HBUS Funds Transfer staff saw the message "do not mention our name," they rejected the 



751 Subcommittee interview of Anne Liddy (2/22/2012). 

752 2/3/2003 email from HBUS David Bagley to HBME Rick Pudner and others, "Business Case-US Payments From 
Iranian Banks/Entities," HSBC OCC 8876487-488. 

753 Id. 

754 Id. at 8876488. 

755 2/3/2003 email from HBME Nigel Weir to HSBC David Bagley and others, " Business Case-US Payments From 
Iranian Banks/Entities," HSBC OCC 8876487. 

756 Deloitte, Results of the transactions Review - UK Gateway, March 29, 2012. HSBC-PSI-PROD-0197919, at 62. 
The Deloitte review examined HBEU and HBME Iranian transactions sent through U.S. dollar accounts at both 
HBUS and JPMorgan Chase. 

757 See 6/17/2003 email from HBUS Elizabeth Protomastro to HSBC John Root and HBUS Carolyn Wind, "Re: 
PLC-Re "do not mention our name," at HSBC OCC 8873922. 

758 6/16/2003 email from HBUS Elizabeth Protomastro to HBUS Carolyn Wind and HBUS Anne Liddy, "PLC-Re 
"do not mention our name," HSBC OCC 8873925. 
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payment in accordance with HBUS policy, "due to concerns about evasion issues under the 

759 

OFAC regulations." Ms. Protomastro explained that HBUS would not process a payment 
containing such a message, even if it qualified as a permissible U-turn transaction. 

On June 17, 2003, Mr. Root forwarded the payment details to HSBC Group Compliance 
head David Bagley. 760 Mr. Bagley responded by asking if they should allow a payment "with 
this sort of instruction to be passed to HBUS, regardless of the wider issue as to the applicability 
of OFAC to non us persons." 761 

The June 2003 transaction once again made several senior officials at HBUS and HSBC 
Group aware that HSBC affiliates were sending undisclosed OFAC sensitive transactions 
through HBUS accounts, even though HBUS had yet to approve a U-turn protocol. When asked 
about this incident, Ms. Wind told the Subcommittee that she did not recall what HSBC Group 
Compliance said or did about the payment. 762 She also did not recall whether there was an 
inquiry made to identify similar transactions, whether the transaction was reported to OFAC, or 
whether a SAR was considered or filed. When asked who in HBUS was responsible for 
following up on the incident, she replied that from the business side, Denise Reilly and her 
supervisor Michael Gallagher, and from the compliance side, herself and her supervisor Anne 
Liddy. 763 When Mr. Gallagher was asked about the incident, he responded that it was not his 
responsibility to take action, because blocked payments are an operational and compliance effort, 
not a PCM issue. 764 He stated that he would not have had the authority to either stop or release a 
suspect payment; operations staff, including Denise Reilly, did not report to Mr. Gallagher in 
2003. 

Using "Selves" Instead of Client Names. In August 2003, internal bank documents 
show that Compliance personnel in HSBC Group and HBEU learned of, and objected to, the 
practice of some HBEU personnel, when sending Iranian U-turn transactions, to alter the 
payment instructions and identify HBEU itself as the active party in the transaction, rather than 
use a client name that might trigger HBUS' OFAC filter. Despite their objections, the practice 
continued for years. 

On August 20, 2003, the head of HSBC Group Audit Matthew King informed HSBC 
Group Compliance head David Bagley that "HBEU continues to send remittances to the US with 
'selves' noted as the ordering party when the transfer would otherwise be filtered out for OFAC 
sanctions reasons." 765 He wrote: "I recall that this has been raised in the past, but I thought we 
had agreed the practice would cease. Are you aware of the current position?" 



" y 6/17/2003 email from HBUS Elizabeth Protomastro to HSBC John Root and HBUS Carolyn Wind, "Re: PLC-Re 
"do not mention our name," HSBC OCC 8873922-923. 

760 Id. 

761 Id. 

762 Subcommittee interview of Carolyn Wind (3/7/2012). 

763 Id. 

764 Subcommittee interview of Michael Gallagher (6/13/2012). 

765 8/20/2003 email from HSBC Matthew King to HSBC David Bagley and others, "OFAC," HSBC OCC 8876504- 
505. 

766 Id. at 8876505. 
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On September 1, 2003, Mr. Bagley forwarded Mr. King's email to John Root and asked 
him to investigate. 767 Mr. Bagley wrote that there is now "some clarity" that OFAC prohibitions 
do not apply to non-U. S. persons, even when payments are denominated in U.S. dollars. 768 He 
also wrote that an established payment mechanism exists for bank-to-bank transfers, which did 
not require underlying payment information and which might apply to HBEU transfers to 
HBUS. 769 Mr. Root agreed to look into the matter. 

On September 2, 2003, HBEU Compliance manager Julie Clarke sent an email to an 
individual whose name was redacted by HSBC seeking more information about the transactions 
that triggered the inquiry by HSBC Group Audit head Matthew King. The email recipient 
responded: 

"During the conversation, I mentioned that historically we used "selves" but that I had 
stopped the practice as soon as I had discovered it in mid- 2000. He stated that it was still 
done in HBEU. This was not in connection with [redacted] payments and I have no 
examples." 771 

The following day Ms. Clarke forwarded the email to Rod Moxley in HBEU's Multicurrency 
Payment Department (MPD), and asked him for more information regarding the practice of using 
"ourselves" in a payment message. 772 

On September 8, 2003, Mr. Moxley responded to Ms. Clarke. 773 He explained that the 

774 

OFAC sanctions issue had been "under discussion for some time" within MPD. He forwarded 
to her an August email that he had sent to Pat Conroy, Malcolm Eastwood's supervisor, 
addressing various issues related to OFAC sensitive transactions. The August email indicated 
that a certain person, whose name was redacted by HSBC, had brought "our current practice 
regarding the alteration of the remitter field on Iranian payments to the attention" of Matthew 
King and David Bagley. 775 The August email also stated that "[t]he specific issue with Iran had 
been formally raised with the RM [Relationship Manager], John Wilkinson" who had been 
"given a deadline of 31 December 2003 to remedy this situation." The August email also noted: 



/6 '9/l/2003 email from HSBC David Bagley to HSBC John Root and HSBC John Allison, "OFAC," HSBC OCC 
8876504. 

768 Id. Mr. Bagley told the Subcommittee that the applicability of OFAC prohibitions to non U.S. persons was an 
undecided issue in 2003, with legal opinions offering differing conclusions. Subcommittee interview of David 
Bagley (4/12/2012). OFAC now takes the position that its prohibitions apply to all U.S. dollar transactions, 
including those involving non-U. S. persons. 

769 9/1/2003 email from HSBC David Bagley to HSBC John Root and HSBC John Allison, "OFAC," HSBC OCC 
8876504. As explained earlier, at that time, bank-to-bank transfers could be executed on forms which required 
information on the remitting and beneficiary banks, but not the underlying customers. 

770 9/2/2003 email from HBEU Julie Clarke to [redacted], "OFAC sanctions," HSBC OCC 8876824-825. 

771 Id. at 8876824. 

772 9/3/2003 email from HBEU Julie Clarke to HBEU Rod Moxley and Chris Pollard, "OFAC Sanctions," HSBC 
OCC 8876824. 

773 9/8/2003 email from HBEU Rod Moxley to HBEU Julie Clarke, "OFAC Sanctions," HSBC OCC 8876820-821. 

774 Id. at 8876821. 

775 8/22/2003 email from HBEU Rod Moxley to HBEU Pat Conroy, "Project Wolf," HSBC OCC 8876821-822. 
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"Malcolm's stance, I understand, is that any payments after 31 December 2003 will not be 
processed unless signed off at a very senior level." 776 

That same day, September 8, 2003, Ms. Clarke forwarded the email chain to HBEU 
Compliance officer Paul Proctor and wrote: "It appears that John Wilkinson has been allowed to 
continue (to 31/12/03) to use 'selves' as the remitter name for Iranian payments which I believe 
contravenes your recently issued guidelines." 777 Mr. Proctor responded: 

"This is the first time I have seen in writing, an admission that Payments Services are 
amending payments by removal of either the remitter's name or country to prevent the 
probable trigger of the US filter and the subsequent freezing of funds. 

You indicate that Group Compliance have now forbidden you to tamper with such 
payments, which I would fully support as it flies in the face of Group policy re complying 
with the spirit and letter etc." 778 

This email indicates that HBEU Compliance had not been aware the some HBEU personnel were 
continuing to alter documentation connected to OFAC sensitive transactions, in defiance of new 
guidelines prohibiting such conduct. The email also indicates that HSBC Group Compliance had 
instructed HBEU Compliance that HBEU personnel were "forbidden" to "tamper" with the 
documentation. 

When asked about these emails, Mr. Bagley told the Subcommittee that, in October 2003, 
Mr. Root reported to him that HBEU Compliance had admitted HBEU was still altering Iranian 
U-turn transaction documentation, despite a recommendation by HBEU Compliance that it 
cease. 779 Mr. Bagley told the Subcommittee that HBEU had explained that it had been sued 
when payments were blocked by the HBUS filter, so it was using cover payments to avoid 
additional operational losses. Mr. Bagley also explained that neither HBEU Compliance nor 
HSBC Group Compliance could simply order a business unit to cease a particular practice; each 
could only "recommend" a course of action which it had done. 

The internal bank documents show that, in the fall of 2003, Mr. Eastwood and Mr. 
Moxley in MPD, HBEU Compliance manager Julie Clarke and Compliance officer Paul Proctor, 
as well as the heads of HSBC Group Audit and Compliance, expressed repeated concern about 
actions taken by persons like the HBEU Relationship Manager for Bank Melli John Wilkinson to 
alter U-turn transaction documentation in a way that would avoid the OFAC filter; all agreed the 
practice should stop. HBEU Compliance took the step of issuing guidelines recommending 
against such conduct, but HBEU personnel apparently ignored the guidance. 



9/8/2003 email from HBEU Julie Clarke to HBEU Paul Proctor and others, "OFAC sanctions evasion - Iranian 
payments," HSBC OCC 8876819-820. 

778 9/8/2003 email from HBEU Paul Proctor to HBEU Julie Clarke and others, "Re: OFAC sanctions evasion - 
Iranian payments," HSBC OCC 8876818-819. 

779 Subcommittee interview of David Bagley (5/10/2012). 
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Proposal to Expand U.S. Dollar Clearing for Iranian Banks. In October 2003, 
HBME increased the pressure on HBUS to process Iranian transactions by proposing to expand 
its U.S. dollar clearing business in Iran. In early October, HBME Planning head Steve Banner 
circulated a document entitled, "Iran - Strategy Discussion Paper," to several senior bank 
executives, including HBME Deputy Chairman David Hodgkinson; HBME Global Relationship 
Manager for the Middle East Nigel Weir; HSBC Group Compliance deputy head Warren 

781 

Learning, HBUS General Counsel Paul Lee, and HBUS Compliance head Carolyn Wind. The 
strategy essentially sought approval for HBME offering U.S. dollar payment services to more 
Iranian banks since, as the strategy noted, "the Iranian market offers substantial untapped 
potential for the HSBC Group." 782 

The strategy listed "significant business wins" involving Iran, in the Project and Export 
Finance, Trade Finance, and Treasury and Capital Markets areas with an estimated $7 million 

TOO 

per year in revenues generated by Iranian businesses for "various Group entities." In a section 
entitled, "Phase 1 - Immediate Opportunities," the strategy stated that Iran's annual international 
trade business was valued at $25 billion, 80% of which was denominated in U.S. dollars. It 
stated that HBEU PCM currently offered U.S. dollar payment services to four Iranian banks, and 
could market the same services "to other Iranian commercial banks, including Iran's Central 
Bank (Bank Markazi)." It estimated the potential business as worth up to $4 million per year. 

The strategy also noted an upcoming change in U.K. law that would require U.K. bank- 
to-bank transfers to identify, not only the banks involved in the transfer, but also their underlying 
customers. It stated that the impending U.K. legislation, together with U.S. sanctions laws, 
would "significantly complicate the USD payments process for Iranian counter-parties," and if 
"the Group decides to pro-actively promote USD payments services to Iranian banks the 
payments will need to be processed by HBUS with full details to satisfy OFAC requirements." 784 
To facilitate the process, the strategy said that HBME planned to prepare a paper for HSBC 
Group requesting an increase in the country risk limits for Iran. 78 The strategy concluded by 
asking for HSBC Group's approval and HBUS' "no objection" to HBEU's providing U.S. dollar 
services to additional Iranian banks. 786 



The strategy stated clearly that, "HBEU PCM currently offer[s] USD [U.S. dollar] 

787 

payment services to 4 Iranian banks." It once again alerted HBUS to the fact that HBEU was 
already processing U.S. dollar transactions for Iranian banks through its account at HBUS. The 
strategy was sent to both HBUS' legal counsel and top compliance officer. 

On October 15, 2003, the HBUS CEO at the time, Youssef Nasr, sent an email to HBUS 
PCM head Michael Gallagher noting that with regard to Iranian U-turns, "there remain serious 
political and reputational risks within the USA if they proceed with this and that he should 
ensure that Paul Lee is kept in the loop at all times because of the prior work he has done both on 



781 Undated HSBC document, "Iran - Strategy Discussion Paper," HSBC OCC 8873949-956. 

782 Id. at 8873949. 

783 Undated HSBC document, "Iran - Strategy Discussion Paper," HSBC OCC 8873951. 

784 Id. at 8873954. 

785 Id. at 8873952. 

786 Id. at 8873955. 

787 Id. at 8873952. 
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this and some recent approaches from Group offices about opportunities in Libya." When 
asked if Mr. Gallagher discussed the strategy paper with Mr. Nasr, Mr. Gallagher told the 
Subcommittee that he did not recall seeing it. 789 On October 21, 2003, HBUS General Counsel 
Paul Lee contacted HSBC Group Compliance head David Bagley "expressing some concerns" 
about the Iranian strategy. 790 

On October 21, 2003, Mr. Bagley sent an email to HBME officials indicating several 
issues surrounding the U-turn transactions needed clarification and asked whether the costs 
associated with incurring U.S. legal fees made it worthwhile to continue the discussion. Mr. 
Bagley also wrote: 

"I am not sure that HBUS are aware of the fact that HBEU are already providing clearing 
facilities for four Iranian banks, presumably including USD [U.S. dollar] clearance. 
Bank Markazi is named in the OFAC sanctions as a government owned bank and thus on 
the face of it not able to benefit from U-turn exemptions." 791 

On October 26, 2003, HBME Deputy Chairman David Hodgkinson sent an email in 
response to Mr. Bagley. He wrote: "HSBC earns USD7.5m a year from its business dealings 

792 

with Iran and we believe that there is significant long-term potential for growth." Mr. 
Hodgkinson indicated that he was willing to incur costs to investigate the options and find "an 
acceptable way to offer the maximum range of services possible without jeopardizing the 
Group's position in the U.S." 793 Mr. Bagley then directed senior Compliance official John Root 
to work with Gary Boon at HBME on a payment solution. 794 

Root Report. As he had been instructed to do by Mr. Bagley, John Root looked into the 
Iranian U-turn issue. On October 23, 2003, Mr. Root sent an email to Mr. Bagley, HSBC Group 
AML head Susan Wright, Money Laundering Control Officer John Allison, and HBEU 
Compliance officer Paul Proctor. Mr. Root wrote that the Iranian relationship at HBEU 
consisted of a U.S. dollar clearing service volume of approximately 11 payments every business 
day for six banks: Melli, Keshavarzi, Markazi, Sepah, Tejarat, and the Export Development 
Bank. His email again confirmed that HBEU was altering the payment documentation, 
despite HSBC Group Audit head, Matthew King's having expressed concerns about the practice, 
and the HBEU Compliance guidelines calling for the practice to stop by the end of the year. Mr. 
Root wrote: 



/ss 10/15/2003 email from HBUS Youssef Nasr to HBUS Michael Gallagher, "Subject, Re: Iran-USD Payments," 
HSBC OCC 8873942. 

789 Subcommittee interview of Michael Gallagher (6/13/2012). 

790 See 10/21/2003 email exchange among HSBC David Bagley, HBME Steve Banner, and others, "Iran-Strategy 
Discussion Paper," HSBC OCC 8873946-947. 
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792 10/26/2003 email from HBME David Hodgkinson to HSBC David Bagley, "Iran-Strategy Discussion Paper," 
HSBC OCC 8873959. 
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794 Subcommittee interview of David Bagley (5/10/2012). See also 10/28/2003 email from HSBC David Bagley to 
HBME Ajay Bhandoola, "Memo: Iran-Strategy Discussion Paper," HSBC OCC 8873958. 

795 Mr. Root identified two more banks than were referenced in the October Iran strategy paper. 
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"EPS [the payment services team within MPD where Mr. Eastwood and Mr. Moxley 
worked] HBEU have been manually intervening in the processing of Iranian bank 
payment instructions by removing the remitter' s name and country to prevent the 
probable trigger of a filter in the US, and the subsequent declaration to OFAC (and 
possible freezing) of the funds." 

Mr. Root wrote that he believed EPS had been instructed by HBEU Compliance to cease 
this practice, but was unclear when the instructions were given or by whom. He noted that 
HBEU Institutional Banking (IBL) had negotiated an extension until December 31, 2003, due to 
"long-standing valuable relationships." After the December 31, 2003 deadline, Mr. Root stated 
that cover payments would be considered unacceptable, and EPS would have to send HBUS 
fully formatted payment instructions on a MT 100/ 103 serial basis. 

Mr. Root also noted that Project WOLF, an HSBC Group project developing an 
automated payment filter to screen transactions for terrorists, would not ensure HBEU 
compliance with U-turn regulations in the United States. As a result, he said that HBUS would 
continue to be responsible for screening all U.S. dollar transactions with regard to OFAC 
prohibitions. 797 

Moxley Deadline. The following day, John Root forwarded David Bagley, Susan 
Wright, and John Allison an email from Rod Moxley in HBEU's Multicurrency Payments 
Department (MPD) expressing Mr. Moxley' s objection to participating in procedures designed 
to conceal U-turn transactions. In his October 24, 2003 email, Mr. Moxley first objected to the 
notion that the MPD procedures being used for Iranian transactions were new or unknown: 

"I have been alarmed by recent inferences that Payment Services have been amending the 
Iranian banks' payments without the knowledge or consent of IBA1 RIM or IBL 
Compliance. This has been a long standing practice and to avoid future doubt, I will 
reiterate the points made in Malcolm Eastwood's memo to Niger Weir of 22 Jan. 03. " 798 

Mr. Moxley also stated that the position of his office in terms of processing the Iranian payments 
was becoming "increasingly untenable." He wrote that HBEU Risk Management Services 799 
would be controlling the new WOLF filter, but "we have been requested to find ways to 
circumnavigate our own and other institutions' compliance filters." 800 He described his role as 
protecting the bank from reputational risk, but "I now feel uncomfortable in compromising my 
position by leading IBL, PCM or Iranian counterparties down certain routes which may directly 
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799 RMS was located within HBEU's Payment Services. Subcommittee interview of Rod Moxley (6/7/2012). 

800 10/24/2003 email from HBEU Rod Moxley to HBEU John Wilkinson and others, "Iran," HSBC OCC 8874661- 
663. 
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contravene the spirit of the Compliance framework." Mr. Moxley warned that, given the 
internal HBEU deadline to stop processing concealed Iranian transactions, beginning January 1, 
2004, "no Iranian payments will be amended." 802 

On November 11, 2003, HSBC Group Money Laundering Control Officer John Allison 
sent an email to HSBC Group AML head Susan Wright about his visit to HBEU's Multicurrency 
Payments Department (MPD) the week prior to discuss Iranian payments. He wrote that 
Iranian correspondent bank customers entered payment information on a form, and MPD staff 
were then expected to review the form to ensure the phrases "Iran," "do not mention Iran," or 
any other compromising reference were not included in the MT202 payment message transmitted 
to HBUS. He described this process as "established custom" rather than a documented 
procedure, "believed by MPD to be at the request of relationship management." He also wrote 
that the new MPD Compliance manager was "not comfortable with the custom which he has 
inherited, neither from a moral compliance perspective, nor from the operational 
loss/embarrassment factor." Mr. Allison also wrote that MPD Compliance is "very 
uncomfortable" about periodically being asked by Nigel Weir and Gary Boon in HBME whether 
a specific payment format will pass through an OFAC filter. 804 He stated that MPD Compliance 
viewed all of the Iranian payments they processed as meeting the requirements for a permissible 

805 

U-turn transaction, and wanted to move toward the legitimate execution of these payments in 
light of what Mr. Root described as an "instruction" from Mr. Bagley "to cease processing 
Iranian bank payments." 806 

On November 27, 2003, Mr. Moxley sent Ms. Wright a draft proposal to process Iranian 
U.S. dollar transactions. Although the proposal would prohibit altering a transaction document 
to remove the name of a prohibited country or town, and required a review for OFAC 
compliance, it did not require the transaction to include full payment details for the originator 
and ultimate beneficiary as outlined in the HBUS August 2001 U-turn payment procedure. 

On December 10, 2003, after having consulted HBUS Compliance head Carolyn Wind, 
Ms. Wright sent Mr. Moxley an email updating him on the Iranian U-turn payment proposal. 808 
Ms. Wright indicated that the issue of processing payments through HBUS had been "discussed 
at length" among HBUS Compliance, outside legal counsel Tom Crocker, HBUS payments 
personnel, and HBEU during the summer of 2001. She indicated she had asked Ms. Wind to 
forward the 2001 HBUS proposal for consideration. The following day, Nigel Weir wrote to Ms. 
Wright that the HBUS proposal required a method for processing payments that was not 



801 Id. at 8874662. 

802 Id. at 8874662. 

803 1 1/1 1/2003 email from HSBC John Allison to HSBC Susan Wright, "Iran payments," HSBC OCC 8877136-137. 

804 Id. at 8877136. 

805 Id. at 8877137. The email did not address the issue of whether Bank Markazi, as a government owned Central 
Bank, was unable to utilize the U-turn exception. 

806 Id. at 8877137. Although Mr. Root indicated that Mr. Bagley had ordered the MPD payments to "cease," they 
continued for another two years. 

807 1 1/27/2003 email from HBEU Rod Moxley to HSBC Susan Wright, "Draft Iranian - USD Payment Procedures," 
HSBC OCC 8875225-232. 

808 12/10/2003 email from HSBC Susan Wright to HBEU Rod Moxley and others, HSBC OCC 8875508. 
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HBME's preferred solution. He also expressed concern that HBEU would be unable to advise 
their customers of the proposed processing changes before the December 31 deadline and 
requested an extension. Ms. Wright forwarded the correspondence to Mr. Bagley. 

On December 12, 2003, Mr. Bagley emailed Mr. Weir that if HBUS felt it could agree to 
processing the Iranian transactions only on the basis of fully transparent documentation, then its 
views would have to be taken into account. He also wrote that HBUS "must be comfortable" 
with the approach. 

HBEU continued, however, to object to the new payment procedure. On December 18, 
2003, HBEU wrote to HSBC Group Compliance that HBUS' procedure, which it referred to as 
"the serial method," " requires a large amount of work prior to commencement, a 
disproportionate amount of expense and a higher than average risk to the banks reputation being 
damaged by a future payment." 810 

At the same time HBEU and HBUS were arguing over payment procedures, HBEU and 
HBME continued to send transactions involving Iran through their correspondent accounts at 
HBUS, the vast majority of which were undisclosed. A later analysis performed by an outside 
auditor at HBUS' request found that, in 2003, HSBC affiliates sent at least 5,400 Iranian 
transactions to U.S. dollar accounts in the United States, of which about 90% were not 

Oil 

disclosed. 

Also in December, HBUS payments services head Denise Reilly spoke with HBUS' new 
AML Director Teresa Pesce, who began work in September 2003, about the Iranian issue and 
sent her a copy of the 2002 Eastwood memorandum describing how HBEU altered 
documentation and used cover payments to send U.S. dollar transactions involving Iran through 

812 

their correspondent account at HBUS without HBUS' knowledge. Ms. Reilly' s email 
indicated that Ms. Pesce had also discussed the issue with Mr. Gallagher the previous day, 
although Mr. Gallagher told the Subcommittee he did not recall either seeing the memorandum 
or discussing it with Ms. Pesce. 813 



8lw See 12/1 1/2003 email exchange between HSBC Susan Wright, HBME Nigel Weir, and others, " Iran - U-Turn 
Payments," HSBC OCC 8877150-154. 

810 12/18/2003 email from HBEU Tony Collins to HSBC John Allison and others, "Memo: Re: Iran - U-Turn 
Payments," HSBC OCC 8873974-975. 

Group Compliance John Allison and John Root sought legal advice from outside counsel Tom Crocker of Alston & 
Bird and Mr. Crocker determined that "it is not clear that the cover payments meet the requirement of the U.S. 
Dollar u-turn exception to the Regulations." 1/8/2004 memo from Thomas Crocker to John Root and John Allison, 
"Iranian U.S. Dollar U-Turn Transactions and Cover Payments," HSBC OCC 8903992-000. 

811 Deloitte presentation, "March 29, 2012," HSBC-PSI-PROD-0197919, at HSBC OCC 8966143. The Deloitte 
review examined HBEU and HBME Iranian transactions sent through U.S. dollar accounts at HBUS and other U.S. 
banks. 

812 See 12/17/2003 email from HBUS Denise Reilly to HBUS Teresa Pesce, "Compliance - OF AC Issues in General 
and Specific to Iran," HSBC OCC 3407517-522 ("Attached is the memo that we discussed yesterday in our meeting 
with Michael Gallagher."). See also 1 1/14/2002 memorandum from HBEU Malcolm Eastwood to HBUS Denise 
Reilly and HBEU Geoff Armstrong, "Compliance - OF AC Issues in General and Specific to Iran," HSBC OCC 
7688824. 

813 Id.; Subcommittee interview of Michael Gallagher (6/13/2012). 
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(e) Reaching Agreement 

Despite the HBEU deadline announced by Rod Moxley, that MPD would stop processing 
concealed Iranian transactions after December 31, 2003, no agreement was reached by that date 
on how to process the transactions. Documents obtained by the Subcommittee indicate that 
HBEU did not adhere to its deadline, but continued to process Iranian transactions using cover 
payments and deleting any references to Iran in the payment instructions. 

On March 10, 2004, after an Iranian transaction was detected and halted in London, 
HBEU MPD head Malcolm Eastwood wrote: "I remain extremely uncomfortable with the 

814 

practice of amending Iranian payment orders for whatever means." Mr. Eastwood advised 
HBEU Compliance and Institutional Banking to resolve the issue as soon as possible and 
remarked that his Compliance certificate is "heavily caveated to reflect that we are not compliant 

815 

in respect of Iran." Mr. Eastwood sent a copy of his email to HSBC Group AML head Susan 
Wright who forwarded it to David Bagley. 

The following day, Mr. Bagley responded to Mr. Eastwood by writing that he understood 
and shared his concerns, but believed his comments underestimated "the complexity of the 
OFAC regulation, and the competing competitive pressures across the Group." 816 Mr. Bagley 
also wrote that one reason for the slow resolution was that "HBUS was unaware that any 
arrangements existed with Iranian banks." 

On March 22, 2004, more than two years after becoming head of HSBC Group 
Compliance, David Bagley confronted HBME Deputy Chairman David Hodgkinson about the 
need to change how HBME was handling U.S. dollar clearing activity for Iranian banks. 817 Mr. 
Bagley wrote that he was "uncomfortable with this activity in its current form," and "the amount 
of revenue may not justify" the "additional work and investment" required, "nor would it justify 
ru[n]ning the reputational and regulatory risk in the US." He expressed his willingness to 
discuss the issue further, but suggested "that any such conversation take place over the 
telephone, as we are seeking to avoid correspondence with HBUS on this sensitive issue other 
than through lawyers so as to preserve privilege." 818 

WOLF Filter Announced. On March 23, 2004, HSBC Group issued a new Group 

819 

Circular Letter 040021 implementing a major new initiative on "Payment screening." The 
circular announced that HSBC Group had developed an internal filter called "WOLF" to screen 
against terrorists and sanctioned countries and persons. The circular explained: 



814 3/10/2004 email from HBEU Malcolm Eastwood to MDBK (Midland Bank) Quentin Aylward and others, " 
BankMarkazi Payment," HSBC OCC 8873979-980. 

815 Id. at 8873980. 

816 3/1 1/2004 email from HSBC David Bagley to HBEU Malcolm Eastwood and others, "Bank Markazi Payment," 
HSBC OCC 8873985-986. 

817 3/22/2004 email from HSBC David Bagley to HBME David Hodgkinson and HSBC Warren Learning, "Iran - 
Correspondent Banking Services," HSBC OCC 8873995-997. 

818 Id. 

819 3/23/2004 "GCL 040021: Payment screening," prepared by HSBC Group, HSBC OCC 0953080-084. 
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"As part of the international effort to combat terrorism, Competent Authorities in 
numerous countries have published lists of names that are known to be, or are believed to 
be involved in terrorist activity. ... In addition . . . sanctions against a number of 
countries and names are imposed .... Compliance with these sanctions and orders has to 
date relied upon manual processes to identify when relevant names are contained in 
payment instructions. In order to ensure that compliance with the restrictions ... is 
achieved consistently across the Group, an automated payment screening utility named 
WOLF has been developed. When installed . . . WOLF will, before execution, search all 
fields of a payment message for matches with listed terrorist/sanctioned names. Once a 
potential match with a word or words ... is identified, the unexecuted payments must be 
reviewed to establish whether the match is actually a true match, with appropriate action 
taken if it is. WOLF is the Group solution for real-time pre-execution payment 
screening. 

The circular indicated that globally, WOLF would screen against terrorists listed by the 
United Nations, United States, United Kingdom, European Union, and Hong Kong, as well as 
countries or persons sanctioned by the United Nations. It indicated that compliance and payment 
operations personnel in HSBC affiliates were responsible for ensuring WOLF was loaded with 

821 

other sanctioned names that were applicable locally. It indicated that the screening would be 
applied first to international transactions, and later to domestic ones. The circular required 
affected HSBC entities to install the WOLF filter by the end of 2004. 

HEME Extension. On April 17, 2004, HBME Deputy Chairman David Hodgkinson 
contacted David Bagley about the unresolved issues involving HBME's U.S. dollar clearing 
business for Iran, because he anticipated having to explain HSBC's position to the Central Bank 
during a visit to Tehran in May. Mr. Hodgkinson noted: "The current position as briefed to me 

899 

last week was that we have not yet found a way to handle major USD clearing business." He 
informed Mr. Bagley that he had directed his staff to develop a proposal to undertake this 
business while minimizing risk, "so that if circumstances change we know our preferred way 
forward." 823 



Mr. Bagley forwarded the email to his supervisor, HSBC Group legal counsel Richard 
Bennett. Mr. Bagley wrote: "[T]he most pressing issue to be resolved is that relating to the 
limited number of existing relationships that we have (for two small Iranian Banks) where I 
suspect that HBUS are not aware that payments may be passing through them. Do not believe 
that we can allow this situation to continue very much longer, which is the point I will make to 

894 895 

David in my response." This email is the third in which Mr. Bagley indicated that HBUS 



821 Id. HSBC added the OF AC SDN list to the WOLF filter in 2004, and added the OFAC country list in August 
2005. Subcommittee briefing by Cahill Gordon & Reindel LLP (6/20/2012). 

822 4/17/2004 email from HBME David Hodgkinson to HSBC David Bagley and HSBC Warren Learning, " Iran - 
Correspondent Banking Services," HSBC OCC 8874671. 

823 Id. at 8874671. 

824 4/19/2004 email from HSBC David Bagley to HSBC Richard Bennett, "Iran Correspondent Banking Services - 
OFAC," HSBC OCC 8873994 and HSBC OCC 8966146. Mr. Bagley had allowed these payments to continue by 
granting a dispensation since they ran afoul of Group policy. However, an increase in business, which is what 
HBME was seeking, was on hold pending an agreement between HBUS, HBEU, and HBME. 
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might be unaware it was processing Iranian U-turn transactions that, in his own words, "may 
constitute a breach of U.S. sanctions," yet contained no indication that Mr. Bagley planned to 
inform HBUS about the risks it was incurring. 

Two days later, on April 19, 2004, Mr. Bagley again pressed HBME to resolve the issue. 
In an email to Mr. Hodgkinson, Mr. Bagley expressed concern about the correspondent 
relationships operating through HBME "which do not currently meet the requirement of the US 
Legal opinion that has now been obtained." 826 He continued: "I have sanctioned the 
continuation of these services pending an early resolution of the way forward, but it is clear from 
your note that we are some distance away from finalizing our thinking such that we can go to 
HBUS with any proposal with regard to a way forward." Mr. Bagley warned: "I feel that there 
is little option other than for me to recommend to HBEU that the existing activity be 
discontinued given the risk that we are posing for HBUS, unless the solution under consideration 
at your end gives us a satisfactory option." 

HBME's Nigel Weir responded to Mr. Bagley' s email at the request of Mr. Hodgkinson, 
stating that he had already spoken with Gary Boon at HBME and John Allison at HSBC Group 
to develop a solution. He also requested that Mr. Bagley extend the dispensation from the 

827 

HBEU decision to stop altering Iranian documentation until June 30, 2004. Two days later, 
Mr. Bagley told John Allison that he was reluctant to extend the dispensation "unless there is a 
clear and agreed solution with a definite and proximate implementation date," and requested an 
update the following week. 828 Despite Mr. Bagley' s indication that he would not grant an 
extension without an agreement, the same practices continued amid ongoing negotiations over 
the agreement's provisions. 

Second Moxley Deadline. About eight months after Mr. Moxley had raised strong 
objections to continuing to alter Iranian payments, no agreement had been reached among HSBC 
affiliates on increasing the transparency of the transactions. HBEU continued to delete 
references to Iran from the payment instructions, generate cover payments with incomplete 
payment information, and send undisclosed Iranian payments to HBUS. To break the impasse, 
in June 2004, outside legal counsel in the United States proposed a new payments solution, 
which essentially required that all U-turns be processed by HBUS in a transparent or "serial" 
manner that identified the underlying originators and beneficiaries. 



The other two were a 10/21/2003 email from HSBC David Bagley to HBME Steve Banner, and others, "Iran- 
Strategy Discussion Paper," HSBC OCC 8873946-947 ("I am not sure that HBUS are aware of the fact that HBEU 
are already providing clearing facilities for four Iranian banks, presumably including USD clearance."); and a 
3/1 1/2004 email from HSBC David Bagley to HBEU Malcolm Eastwood and others, "Bank Markazi Payment," 
HSBC OCC 8873985-986 ("The complexity of the OF AC regulations, and the fact that HBUS were unaware tha 
any arrangements existed with Iranian Banks, has made speedy resolution of this issue difficult."). 

826 4/19/2004 email from HSBC David Bagley to HBME David Hodgkinson, "Iran - Correspondent Banking 
Services," HSBC OCC 8966135. 

827 5/2/2004 email from HBME Nigel Weir to HSBC David Bagley and others, " Iran - Correspondent Banking 
Services," HSBC OCC 8874673-674. 

828 5/4/2004 email from HSBC David Bagley to HSBC John Allison, " Iran - Correspondent Banking Services," 
HSBC OCC 8874673. 
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On June 9, 2004, HBEU senior payments official Rod Moxley reacted negatively to the 
proposal due to operational difficulties. At the same time, he wrote: "I feel very uncomfortable 
recommending that we continue to process Iranian payments." 829 He requested a formal 
response by June 18, 2004, and stated that "unless compelling commercial reasons" approved by 
HSBC Group Compliance and HBUS exist, he would stop handling Iranian payments after 
September 30, 2004. This email represented his second attempt to cut off Iranian payments 
that MPD was uncomfortable processing. 

On June 30, 2004, Nigel Weir wrote to Mr. Moxley and asked him to revisit the issue and 
work with HSBC Group Compliance on a solution enabling HBEU to execute U.S. dollar 

83 1 

payments for Iranian banks in accordance with U.S. regulations. Mr. Weir told Mr. Moxley 
that if the payments were stopped, "we will be effectively insulting the Government and State of 
Iran." Mr. Weir stated that the bank had declined new U.S. dollar payment business from Iranian 
banks due to the sensitive political situation, "but to exit business which we have been 
conducting for many years would jeopardize all other existing business activities." He estimated 
that the Group profit from existing Iranian business activities amounted to $10 million per year. 

Also on June 30, 2004, HBME Deputy Chairman David Hodgkinson forwarded the 
correspondence between Mr. Moxley and Mr. Weir to then HBEU CEO Michael Geoghegan, 
asking for his "intervention and support" in positively resolving the long-standing issue, and 
noting Iran's "significant strategic importance" to the Group. Mr. Hodgkinson also noted that 
the volume of Iranian payments was small at 20 per day. When asked about this email, Mr. 
Moxley told the Subcommittee that it resulted in HBEU and HBME's obtaining a "dispensation" 

833 

from having to end the alteration of Iranian transactions until the end of 2004. When asked 
about the dispensation approval process, he said that he thought that HSBC Group Compliance 
approval was needed along with secondary approval from either HSBC Group Audit or another 
manager. 

Later that day, another HBEU official John Ranaldi sent an email to Mr. Geoghegan 
stating that he was aware of the Iranian situation and would get an update. He wrote: 
"[B]asically, our interpretation was that we were being asked to 'fudge' the nature of the 

834 

payments to avoid the U.S. embargo and seizure." When asked about this email, Mr. 
Geoghegan told the Subcommittee that he could not explain what Mr. Ranaldi meant by using 
the word "fudge," except that it related to Iran. 835 He said that, at the time, he was unaware that 
HBEU was altering transaction documentation or using cover payments. Having since learned 
what was going on, he told the Subcommittee that he assumed that's what Mr. Ranaldi was 
talking about. When asked whether it raised alarm bells at the time, he remarked that he got 



82y 6/9/2004 email from HBEU Rod Moxley to HSBC John Allison and others, "Iran," HSBC OCC 8874002-004. 

830 Id. 

831 6/30/2004 email from HBME Nigel Weir to HBEU Rod Moxley and others, "Memo: Re: Iran," HSBC OCC 
8874001-002. 

832 6/30/2004 email from HBME David Hodgkinson to HBEU Michael Geoghegan, "Memo: Re: Iran," HSBC OCC 
8874001. 

833 Subcommittee interview of Rod Moxley (6/7/2012). 

834 6/30/2004 email from HBEU John Ranaldi to HBEU Michael Geoghegan, "Memo: Re: Fw: Iran," HSBC OCC 
8873999. 

835 Subcommittee interview for Michael Geoghegan (5/24/2012). 
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many emails and Mr. Ranaldi used colorful language. He said that he also knew Mr. Ranaldi 
would follow-up with him in a few days. 

HBEU Proposal. On July 6, 2004, HBEU's Rod Moxley produced a specific proposal 
as a potential way forward using his preferred solution of serial payments. The extensive 
proposal also shed light on existing practices at HBEU. 837 

The proposal noted that HBEU had been trying to come up with a solution for two years 
after an HBEU compliance officer challenged the practice of altering Iranian payment 
instructions in June 2002. It noted that Bank Melli, Bank Markazi, Bank Tejarat, Bank 
Kesharvazi, and the Export Development Bank of Iran were the five Iranian financial institutions 
that took advantage of this practice to effect U.S. dollar payments with a daily volume estimated 
at between 10 and 50 payments per day at an approximate total value of $500,000 to $1 million. 
The proposal also noted that the Central Bank payments were much larger, in the range of $10 

838 

million, and were typically made at certain times of the month. The proposal stated that the 
"vast majority of payments are valid, falling within the U-turn exception." 39 

The proposal discussed two potential payment options that would meet HBUS' 
requirement for transparency. It noted that HBEU preferred the "serial payment" option which 
would allow the Iranian banks to format their payments in a way that would not require 
intervention from HBEU. HBEU believed this aspect of the proposal would relieve it of any 
responsibility to review the payments, leaving it up to HBUS, or another U.S. bank where a 
payment was directed, to verify that the payment met the U-turn exception requirements. The 
proposal indicated that HBEU would continue to utilize WOLF and other filters to screen the 
payments, but the Iranian financial institutions would be responsible for ensuring they submitted 
only valid U-turn payments "permissible under the terms of US legislation." The proposal 
indicated this solution would also transfer the risks associated with blocked payments to the 
Iranian banks. 840 The proposal acknowledged that HBUS would need to agree to this solution, 
and HBEU and Group Compliance would need to "sign-off on it prior to moving forward. 

On July 6, 2004, HBEU MPD head Malcolm Eastwood forwarded Mr. Moxley' s 
proposal to John Ranaldi, noting that he continued to have serious concerns about the Iranian 

841 

U.S. dollar clearing business. Mr. Ranaldi forwarded the email to then HBEU CEO Michael 
Geoghegan, writing: "reference your earlier query." According to Mr. Ranaldi, Mr. 
Eastwood's department was being asked to "amend instructions or assume responsibility that the 



836 See 7/2004 discussion paper, "HSBC Bank PLC Iranian Payment Processing Proposals," HSBC OCC 8874692- 
701. 

837 Id. For example, according to the document, the existing HBEU practice was that if an Iranian financial 
institution included a cautionary statement, such as "Do not mention Iran," in Field 72 of the payment instructions, 
the payment would drop out to what was called a repair queue. Once in the repair queue, HSBC personnel would 
alter the payment instructions by deleting any reference to Iran. 

838 7/2004 discussion paper, "HSBC Bank PLC Iranian Payment Processing Proposals," HSBC OCC 8874692-701. 

839 Id. 

840 Id. at 8874696. 

841 7/6/2004 email from HBEU Malcolm Eastwood to HBEU John Ranaldi and others, "HBEU Iranian Payments 
Business," HSBC OCC 8876861 
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contents of the payment message do not attract the Fed's attention and seize the payment." He 
explained that a "payment clerk is asked to judge upon a payment kicked out by the filtering 
system, whether to release, or return." He wrote, "there is an irony; someone could argue that by 
returning payments to Iran that we are contravening the ofac rules." 843 Mr. Ranaldi 
characterized the risks associated with the existing practice as including operational losses due to 
payment seizure, threats to HSBC's reputation, and "incurring hefty fines." He told Mr. 
Geoghegan that Lloyds Bank had been fined "and few if any u.k. banks are in the business." 

When asked about this email, Mr. Geoghegan told the Subcommittee that he was 
"puzzled" that he didn't act to stop the practice immediately or get out of the business. He 
remarked that he did respond that way with Mexico, so thought it was odd that he didn't in this 
case. He couldn't recall whether he talked to any other senior HSBC Group executives about the 



Emails in early August 2004 show HBEU and HBME reviewing and discussing the 
Moxley proposal. On August 6, 2004, Mr. Bagley commented: "My initial reaction is that the 
proposals are more robust, and therefore more likely to be acceptable that we originally 
contemplated or proposed." 846 He also said the proposal had to be sent to HBUS' outside legal 

847 

counsel for confirmation it would meet OFAC requirements. Later that day, the HSBC Global 
head of Payments and Cash Management, Iain Stewart, forwarded Mr. Bagley' s email to Mr. 
Geoghegan and Mr. Hodgkinson with a note: "Progress report. This will delay it a bit but we 
are getting there." 848 When asked about this email, Mr. Geoghegan surmised that HBUS was 
involved and legal opinions were being obtained. 849 

On September 22, 2004, HBEU Nigel White informed Mr. Stewart and others, including 
Mr. Bagley, that "all involved parties have signed off on the proposal," and the next step was for 

850 

HSBC Group Compliance to obtain agreement from HBUS. At the same time these 
negotiations were ongoing, HBEU and HBME continued to send undisclosed Iranian 
transactions to HBUS with the tacit approval of HSBC Group Compliance. 

HBUS Approval. The revised Moxley proposal was sent to HBUS in November 2004. 
On November 30, 2004, HBUS' AML Director Terry Pesce, PCM head Michael Gallagher, and 
Payment Services head Denise Reilly met with HBUS CEO Martin Glynn, about HBUS 
processing U-turn transactions. Prior to the meeting, Ms. Reilly circulated the HBUS procedures 



7/6/2004 email from HBEU John Ranaldi to HBEU Michael Geoghegan, "HBEU Iranian Payments Business," 
HSBC OCC 8876861. 

844 Subcommittee interview of Michael Geoghegan (5/24/2012). 

845 See 8/4/2004 email exchanges among MDBK Phil Baines to HBEU Nigel White and others, "Iranian - Payment 
Processing Proposals," HSBC OCC 8874705-708. 

846 8/6/2004 email from HSBC David Bagley to HBEU Nigel White and others, " Iranian - Payment Processing 
Proposals," HSBC OCC 8874703-704. 

847 Id. 

848 8/6/2004 email from HSBC Iain Stewart to HBEU Michael Geoghegan and HBME David Hodgkinson, " Iranian 
- Payment Processing Proposals," HSBC OCC 8874703. 

849 Subcommittee interview of Michael Geoghegan (5/24/2012). 

850 9/22/2004 email from HBEU Nigel White to HSBC Iain Stewart and others, "Iranian U Turn Payments," HSBC 
OCC 8874023-037. 
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that were developed in 2001, "when the topic was last active." The internal emails suggest 
that one HBUS employee may have been under the impression that the processing of Iranian 
transactions had not yet begun and did not know that HBUS had already been processing Iranian 
U.S. dollar transactions for at least three years. 852 

A few days after the high level meeting among HBUS officials, Ms. Reilly sent Mr. 
Gallagher a description of "the conditions under which HBUS will accept U-Turn 
transactions." 853 Those conditions included that transactions would be formatted to be fully 
transparent serial payments; HBEU would agree not to alter payment instructions and abide by 
the U-turn processing requirements; HBUS would not be liable for penalties resulting from 
OFAC sanction violations; a separate "HBEU Special Account" would be established at HBUS 
to handle Iranian originated transactions and the account number would be added to the HBUS 
OFAC filter so all transactions could be reviewed and approved prior to processing; HBUS 
would be reimbursed for the additional employees needed to handle review of these payments; 

854 

and fees for the transactions would reflect the processes and risk. Whereas the 2001 protocol 
was specific to Bank Melli, this protocol applied to all Iranian transactions. 855 

On December 15, 2004, Mr. Bagley informed the HSBC Global Head of PCM Marilyn 
Spearing and HBME Deputy Chairman David Hodgkinson that he had advised then HSBC 
Group CEO Stephen Green "that a compliant solution had been agreed in principle with HBUS." 
While this agreement was a significant milestone, Mr. Bagley said Mr. Green wanted to consider 
the issue and possibly discuss it with then HSBC Group Chairman John Bond. 

Mr. Bagley asked Ms. Spearing to provide him data on the potential commercial value of 
the Iranian U.S. dollar transactions to the Group, considering both existing and future business. 
He wrote: 



"I would not suggest that we seek to try and influence the debate at this stage. . . .but it 
might be helpful if I was armed with the likely value to the Group if we are in effect 
making a reputational risk over possible reward type judgment." 56 

Mr. Bagley concluded by writing that it would probably be "sensible" to "gently" proceed 

857 

"assuming that we may get sign-off." 



851 1 1/30/2004 email from HBUS Denise Reilly to HBUS Sandra Peterson and HBUS Michael Gallagher, " U- 
turns," HSBC-PSI-PROD-0096166; 1 1/29/2004 email from HBUS Denise Reilly to HBUS Michael Gallagher and 
others, "U-turns," HSBC-PSI-PROD-0096167. 

852 See, e.g., 1 1/30/2004 email from HBUS Sandra Peterson to HBUS Denise Reilly and HBUS Michael Gallagher, 
" U-turns," HSBC-PSI-PROD-0096165 (Ms. Peterson: "Is this proposal for Bank Melli only or is the intent to grow 
this business? When this topic first arose it was to support Bank Melli but my understanding is that the business 
under discussion now is more general, with no specific clients named to date."). 

853 12/2/2004 email from HBUS Denise Reilly to HBUS Michael Gallagher and others, "U-Turns," HSBC OCC 
3407526-527. 

854 Id. at 3407527. 

855 Subcommittee meeting with HSBC legal counsel (4/12/12). 

856 12/15/2004 email from HSBC David Bagley to HSBC Marilyn Spearing and HBME David Hodgkinson, "Iran - 
OFAC," HSBC OCC 8874039. 

857 Id. at 8874039. 
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An internal OCC memorandum indicates that, in early 2005, HBUS contacted the OCC 

858 

about a proposal to process Iranian U-turns. In the memorandum, an OCC examiner described 
how legitimate U-turns could be processed and wrote: "[W]e notified Ms. Pesce that we 
believed the transactions to be permissible. However, we also informed her that the bank would 
have to maintain extremely tight controls over the transactions as well as a comprehensive 
system of controls for monitoring purposes." Later in the same memorandum, the OCC 
examiner wrote: "[0]n February 23, 2005 Ms. Pesce informed the writer that the decision to 
process the u-turn transactions was not to go forward and that the area business had made the 
decision not to undertake such processing." 

The documentation suggests that even after reaching agreement with HBUS on how to 
process Iranian transactions, HBEU and HBME continued to send undisclosed Iranian 
transactions through their HBUS accounts. A later analysis performed by an outside auditor at 
HBUS' request found that HSBC affiliates sent about 7,800 Iranian transactions through U.S. 
dollar accounts in the United States during 2004, of which more than 90% continued to be 
undisclosed. 861 



(f) Processing the Iranian Transactions 



The 2004 agreement reached among HSBC affiliates on how to process Iranian U-turn 
transactions did not end the controversies or new developments affecting those transfers. 

Considering an Exit. Four months after agreement was reached with HBUS on how to 
process Iranian transactions, on April 8, 2005, David Bagley reached out to Mr. Hodgkinson to 
request an assessment of the nature and extent of Iranian business for an analysis Mr. Bagley was 
asked to prepare for the HSBC Group Chairman. It appears that at the top levels of HSBC, there 
was some discussion about exiting the Iranian business entirely due to a "specific transaction for 
NPC" about which Mr. Bagley had spoken with Mr. Green. In the same email, Mr. Bagley 
wrote, "This is needed partly as part of the risk over reward equation, but also because we will 
need to both analyze each different type of business and assess how we will deal with legacy 
issues." 863 He continued: "It is not all as bad as it seems as the conversation today gave some 
clear possible alternative approaches to an outright ban." 864 

Two days later, on April 10, 2005, HBME official Ajay Bhandoola provided Mr. Bagley 
with a paper discussing payment alternatives for Iran. 865 The paper laid out two proposals for 



858 See 2/28/2005 OCC memorandum, "Issues Update," OCC-PSI-00903648-650, at 2. [Sealed Exhibit.] 

859 Id. 

860 Id. 

861 Deloitte presentation, "March 29, 2012," HSBC-PSI-PROD-0197919, at HSBC OCC 8966143. The Deloitte 
review examined HBEU and HBME Iranian transactions sent through U.S. dollar accounts at HBUS and other U.S. 
banks. 

862 4/8/2005 email from HSBC David Bagley to HBME David Hodgkinson and HBME Nasser Homapour, " Iranian 
Business - OFAC," HSBC OCC 8874052. The reference to NPC is unclear. 

863 Id. at 8874052. 

864 Id. at 8874052. 

865 4/10/2005 email from HBME Ajay Bhandoola to HSBC David Bagley and others, " Iranian Business - OFAC," 
HSBC OCC 8874051-057. 
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continuing payments from Iranian bank accounts with HSBC "to protect our Iranian franchise 
while minimizing any possible legal, regulatory or reputational risk to HBUS." The two 
alternative solutions provided were to use another U.S. dollar correspondent (other than HBUS) 
for HBME, and to limit U.S. dollar accounts for Iranian banks to specific purposes. HBME 
did not explain why it was considering using a third party correspondent since HBUS had 
already agreed to process the Iranian transactions using transparent procedures. 867 

Stopping Payments. On April 19, 2005, HBUS' OFAC filter stopped a $362,000 
payment from Bank Melli, because it contained the phrase "do not mention our name in New 

868 

York." When asked in general about why payments would be stopped in the HBUS filter, 
Rod Moxley told the Subcommittee that messages like the one mentioned above should have 
been deleted in the processing area but was errantly left on the outgoing instructions. 869 This 
incident indicated that HBEU's MPD was still altering Iranian payment instructions in April 
2005, one year after Mr. Moxley had threatened to stop processing all payments if forced to 
continue altering them, and four months after HBEU and HBUS reached agreement on using 
fully transparent Iranian U.S. dollar transactions. HBEU resubmitted the payment on April 22, 
2005, but HBUS stopped it again and sent a SWIFT message requesting full disclosure of the 
name and address of the underlying originator and ultimate beneficiary. Two follow-up requests 
were sent by HBUS on April 28 and May 4, 2005. As of May 5, 2005, no response had been 
received. 870 



In early May 2005, a $6.9 million wire payment involving Iran was also stopped by 
HBUS, because the payment details included the phrase, "Bank Melli Iran." 871 HBUS OFAC 
Compliance officer Elizabeth Protomastro sent an email to HBEU, as well as HSBC Group, 
stating: 

"Though the payment appears to meet the U-turn under the Iranian Transactions 
Regulations, we require that the payments should be fully disclosed as to the originator 
and beneficiary information before processing. We know that this policy is in line with 
the stance of other U.S. financial institutions . . . You are also aware, from past 
discussions, that this is required by HBUS. 

Let us know if you have any questions. Please advise on your side of the delay in 
processing." 872 

The email chain regarding the stopped payment was forwarded to Mr. Bagley, who then 
contacted HBUS AML head Teresa Pesce to ask whether HBUS' action "denotes a change of 



8f * Undated "Iranian Accounts and USD Payments," prepared by HBEU, HSBC OCC 8874055-057. 

867 Id. at 8874056-057. 

868 5/5/2005 email from HBUS Elizabeth Protomastro to HSBC John Allison and others, " Payment rejected re Melli 
Bank PLC - USD 362,000," HSBC-PSI-PROD-0096170-171. 

869 Subcommittee interview of Rod Moxley (6/7/2012). 

870 5/5/2005 email from HBUS Elizabeth Protomastro to HSBC John Allison and others, " Payment rejected re Melli 
Bank PLC - USD 362,000," HSBC-PSI-PROD-0096170-171. 

871 5/3/2005 email from HBUS Elizabeth Protomastro to HSBC John Allison, HSBC Susan Wright, HBEU Rod 
Moxley, and others, "Wire payment suspended re 'Iran' - USD 6,912,607.82," HSBC OCC 887471 1. 

872 Id. at 8874712. 
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policy and approach within HBUS to what I would normally expect to be cover payments." 
Mr. Bagley wrote: 

"As you are aware, there are no Group standards which require that the originator and 
beneficiary details go in all payments. Accordingly, Group Operation globally will not 
habitually require or input this information if the underlying customer instruction is 
received on a basis permitted by the SWIFT format and by local regulation." 

He noted that if the payment were suspended due to a reference to Iran, he understood. But if the 
action taken by HBUS denoted a change of policy on what information had to be included in 
payment instructions, that change may not have been communicated across the Group and vetted 
with business colleagues. This email was sent in 2005, by Mr. Bagley, after more than two years 
of negotiations to increase transparency with regard to Iranian transactions. 

Ms. Pesce forwarded Mr. Bagley' s email to HBUS OFAC Compliance officer Elizabeth 
Protomastro and senior HBUS Compliance official Anne Liddy. Ms. Protomastro responded that 
"for the most part" the U-turns being processed by HBUS for HBEU had been fully disclosed in 

874 

compliance with the conditions specified in December 2004. Ms. Protomastro stated that the 
remitter involved in the $6.9 million transfer was Credit Suisse Zurich, which was "well aware 
of the u-turn practices of other U.S. organizations and the requirement for full disclosure of the 

one 

name and address of the originator and the beneficiary." 

On June 3, 2005, Ms. Protomastro informed HSBC Group about two more HBEU 
transfers, for $1.9 million and $160,000, that had been stopped by HBUS due to the lack of full 

876 

disclosure of the originator, beneficiary, and purpose of the payment. HBEU responded that 
both payments were foreign exchange related, the originators were Bank Tejarat and Bank Melli, 

877 

and the beneficiaries were Persia International Bank and Credit Suisse Zurich, respectively. 
Ms. Protomastro responded by requesting that HBEU follow up with the banks to obtain the 
names and addresses of the initial originators and ultimate beneficiaries, as well as confirmation 
of the underlying purpose of the payments, in accordance with the "agreement reached in the 

878 

past" between HBUS and HBEU requiring full disclosure for U-turn payments. According to 
information provided by Bank Melli through HBEU, the $160,000 payment denoted an internal 
transfer from Bank Melli' s account with HBEU to Bank Melli' s account with Credit Suisse 
Zurich. This information allowed the payment to be released. Mr. Marsden stated that he 



S/J 5/4/2005 email from HSBC David Bagley to HBUS Teresa Pesce, "Wire Payments Suspended," HSBC OCC 
8874710-711. 

874 5/4/2005 email from HBUS Elizabeth Protomastro to HBUS Teresa Pesce and others, " Wire Payments 
Suspended," HSBC OCC 8874710. 

875 Id. at 8874710. 

876 6/3/2005 email between HBUS Elizabeth Protomastro and HSBC John Allison and others, "Wire payments from 
HSBC Bank PLC suspended - USD 1,900,000 and USD 160,000 (Iran)," HSBC OCC 3407547. 

877 6/6/2005 email from HBEU Rod Moxley to HBUS Elizabeth Protomastro and others, "Re: Wire payments from 
HSBC Bank PLC suspended - USD 1,900,000 and USD 160,000 (Iran)," HSBC OCC 3407546-547. 

878 6/6/2005 email from HBUS Elizabeth Protomastro to HBEU Stephen Cooper and others, "Re: Wire payments 
from HSBC Bank PLC suspended - USD 1,900,000 and USD 160,000 (Iran)," HSBC OCC 3407544-545. 

879 6/7/2005 email from HBEU Anthony Marsden to HBUS Grace Santiago-Darvish, "Re: Wire payments from 
HSBC Bank PLC suspended - USD 1,900,000 and USD 160,000 (Iran)," HSBC OCC 3407543-544. 
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was in the process of contacting Bank Tejerat for additional information about the $1.9 million 
transfer. 

On June 6, 2005, Anne Liddy sent HBUS AML head Teresa Pesce the email 

881 

correspondence about the two Iranian payments that had been suspended. She also informed 
Ms. Pesce that 44 of the approximately 60 payments stopped by the HBUS OFAC filter the 
previous month, May 2005, and forwarded for review, referenced Iran. She remarked that this 
was "quite a lot." The following day, HBUS OFAC Compliance officer Grace Santiago-Darvish 
informed HBUS' Payment Services head Denise Reilly that they would be sending a message to 
all HSBC locations to remind them about the need to fully disclose underlying information in U- 
turn payments. She wrote: "We, in Compliance have noticed that, other locations could be more 
forthcoming about disclosing orig[inator], and bene[ficiary] information." 882 

Switch from HBEU to HEME. On May 20, 2005, HBME Deputy Chairman David 
Hodgkinson sent an email to HSBC business heads that, after a meeting with the HSBC Group 
Chairman and Group CEO, a decision had been made to transfer all Iranian bank U.S. dollar 
accounts held by HBEU to HBME, and utilize a "third party correspondent in the US for cover 
and other valid U turn payments." 883 When asked about this decision, David Bagley told the 
Subcommittee that the processing of the payments was moved to HBME because that was where 
the locus of business was located. 884 In addition, HBME set up a special team to review the 
transactions to ensure consistent treatment. Mr. Hodgkinson also informed HSBC business 
heads that they should suspend new business and the expansion of current activities with Iran 
until the political situation improved, but that "existing business and commitments with Iran" 
were allowed to continue. 885 

JP Morgan Chase. On June 20, 2005, David Bagley informed David Hodgkinson that 
Iranian payments had been discussed in a meeting he had with HSBC Group CEO Stephen 

886 

Green and HSBC Group legal counsel Richard Bennett. He wrote that it was decided that all 
U-turns, whether passing through HBUS or another U.S. correspondent, would have to comply 
with the U-turn requirements in OFAC regulations. He wrote that Mr. Green also wanted 
confirmation that the "agreed arrangements in relation to Iranian payments had been put in 
place," and that payments, including any cover payments, passing through the United States 
would comply with OFAC regulations. Mr. Bagley wrote: 



6/7/2005 email from HBEU Anthony Marsden to HBEU Rod Moxley and others, "Re: Wire payments from 
HSBC Bank PLC suspended - USD 1,900,000 and USD 160,000 (Iran)," HSBC OCC 3407544-545. 

881 6/6/2005 email from HBUS Anne Liddy to HBUS Teresa Pesce and others, "Fw: Wire payments from HSBC 
Bank PLC suspended - USD 1,900,000 and USD 160,000 (Iran)," HSBC OCC 3407537. 

882 6/7/2005 email from HBUS Grace Santiago-Darvish to HBUS Denise Reilly and others, "Re: Wire payments 
from HSBC Bank PLC suspended - USD 1,900,000 and USD 160,000 (Iran)," HSBC OCC 3407536. 

883 5/20/2005 email from HBME David Hodgkinson to HBME Nasser Homapour and others, "Iran," HSBC OCC 
8874714. 

884 Subcommittee interview of David Bagley (4/12/2012). 

885 5/20/2005 email from HBME David Hodgkinson to HBME Nasser Homapour and others, "Iran," HSBC OCC 
8874714. 

886 6/20/2005 email from HSBC David Bagley to HBME David Hodgkinson, "Iranian Payments," HSBC OCC 
8878027-029. 
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"Although I may have misunderstood our discussions I was not previously aware that this 
was a precondition nor did my original paper envisage that if we used a non-Group 
correspondent we would necessarily consider passing only U-turn exempt payments 
through them. In fact in such circumstances there would be no reason to use anyone 
other than HBUS given that HBUS could not be criticized were it to carry out exempt 
payments." 887 

Mr. Bagley's comments suggest that he was under the impression that using a non-Group 
correspondent would have allowed HSBC to process Iranian payments that did not meet the U- 
turn exception. However, after his discussion with Mr. Bennett and Mr. Green, he requested that 
Mr. Hodgkinson confirm they would be sending only compliant U-turn transactions through the 
United States, regardless of "whether or not through our own correspondent." 888 

On June 27, 2005, David Hodgkinson responded that HBME was attempting to open a 
U.S. dollar correspondent account with JP Morgan Chase (JPMC) for the purpose of processing 
Iranian U.S. dollar payments. Later in the email he wrote: "we never envisaged anything other 
than U-Turn complaint payments being processed," and confirmed agreement that "there is no 
reason to use anyone other than HBUS." He clarified that the only reason they had considered 
another U.S. correspondent for these payments was due to HBUS being unwilling to process 
them for reputational risk reasons. 889 When Michael Gallagher, the head of HBUS PCM, was 
asked whether he was aware that HBME opened a U.S. dollar account with JPMorgan Chase in 
2005, he could not recall. 890 He further explained that HBME must have thought that HBUS' 
standards were higher if they went to JPMorgan Chase to do the same service. 

Despite that email, HBME did open a U.S. correspondent account with JPMC. Mr. Bagley 
alerted HSBC Group CEO Stephen Green to the account on September 19, 2005, writing that 
HBME had opened a correspondent account with JPMC "through which the pre-screened 

89 1 

compliant U-turn Iranian Payments can be made." A later analysis conducted by an outside 
auditor at HBUS' request found that HBME sent about 1,800 U-turns to its JPMorgan Chase 
account in 2005 and 2006. 892 



Id. at 8878028. With regard to cover payments, Mr. Bagley wrote that failing to consider an entire transaction 
("both the cover payment instruction and any linked bank to bank message"), which if considered together "would 
lead to a different determination in terms of that U-turn exemption," needed to be included in the risk determination. 
Mr. Bagley also referenced heightened concerns about the level of scrutiny from U.S. authorities regarding cover 
payments and OF AC compliance by " US banks offering correspondent banking services," stemming from 
discussions held at a recent Wolfsberg meeting. The Wolfsberg Group consists of major international banks that 
meet regularly and work together to combat money laundering. See http://www.wolfsberg- 
principles.com/index.html. 

889 6/27/2005 email from HBME David Hodgkinson to HSBC David Bagley and HSBC Richard Bennett, "Iranian 
Payments," HSBC OCC 8878026-027. 

890 Subcommittee interview for Michael Gallagher (6/13/2013). 

891 9/19/2005 email from HSBC David Bagley to HSBC Stephen Green and HSBC Richard Bennett, "GCL050047 
"Compliance With Sanctions," HSBC OCC 8874360-361. 

892 Subcommittee briefing by Cahill Gordon & Reindel LLP (6/20/2012); Deloitte presentation, "March 29, 2012," 
HSBC-PSI-PROD-0197919, at HSBC OCC 8966143. The Deloitte review examined HBEU and HBME Iranian 
transactions sent through U.S. dollar accounts at HBUS and other U.S. banks. 
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(g) Establishing Group-wide Policy 

In July 2005, HSBC Group Compliance issued a Group Circular Letter, or GCL, that for 
the first time established Group-wide policy on processing OFAC sensitive transactions, 
including U-turns involving Iran. GCL 050047 explicitly barred all HSBC affiliates and offices 
from participating in any U.S. dollar transaction, payment, or activity that would be prohibited 

893 

by OFAC regulations. The GCL also explicitly acknowledged the U-turn transactions 
permitted under OFAC regulations and required all compliant U-turn transactions be routed 
through an HBME "Center of Excellence" in Dubai for processing. While the policy directed all 
HSBC affiliates to use only permissible Iranian U-turns, the GCL also allowed HSBC affiliates 
to continue to use cover payments when sending them through U.S. accounts for processing, 
which meant the transactions would continue to circumvent the OFAC filter and any 
individualized review by the recipient U.S. bank, including HBUS. 894 

The 2005 GCL also required local U.S. dollar clearing systems, located in Hong Kong 
and the United Arab Emirates, to implement WOLF screening for all U.S. dollar payments to 
ensure that non-compliant payments were rejected. The GCL stated: "Any dispensation from 
the terms of this GCL requires GHQ CMP [Group Compliance] concurrence." Mr. Bagley 
described the GCL as being "necessary and urgent to protect the Group's reputation." 896 

About a month after the GCL was issued, the HSBC Group head of Global Institutional 
Banking, Mark Smith, issued a managerial letter, in August 2005, providing guidance on 

OQ7 

implementing the new policy. The letter provided a brief summary of Group's relationship 

898 

with each of the OFAC sanctioned countries. With respect to Iran, Mr. Smith wrote: "Iran - 
extensive relationships with a number of Iranian institutions. Group Compliance had re-affirmed 
that OFAC sanctions, including the U-turn exception, apply to all transactions." 899 The guidance 
also clarified that the revised policy applied only to U.S. dollar transactions and continued to 
permit non-U. S. dollar business with prohibited countries and persons on the OFAC list. 900 



893 See 7/28/2005 GCL 050047, "Compliance with Sanctions," HSBC OCC 3407560-561. 

894 Id. 

895 Id. 

896 7/26/2005 email from HSBC David Bagley to HSBC Mansour Albosaily and others, "OFAC GCL," HSBC OCC 
3407550-555. Upon receipt of the GCL, on July 26, 2005, Anne Liddy wrote that she would discuss the need for 
OFAC training with John Allison and Susan Wright at their monthly meeting the following day to ensure HBEU and 
HBME "clearly understand OFAC" and "how to identify a true U turn." 7/26/2005 email from HBUS Anne Liddy 
to HBUS Grace Santiago-Darvish and others, "OFAC GCL," HSBC OCC 3407549. 

897 8/25/2005 managerial letter from HSBC Mark Smith to HBUS Aimee Sentmat, HBME Alan Kerr, and others, 
"GCL050047 - Compliance with OFAC sanctions," HSBC OCC 3407565-569. 

898 8/25/2005 Managerial Letter from Mark Smith, "GCL050047 - Compliance with OFAC sanctions," HSBC OCC 
3407565-569. 

899 Id. at 3407568. 

900 8/25/2005 managerial letter from HSBC Mark Smith to HBUS Aimee Sentmat, HBME Alan Kerr, and others, 
"GCL050047 - Compliance with OFAC sanctions," HSBC OCC 3407565-569. 
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Also in August 2005, HBUS circulated an email identifying correspondent relationships 
affected by the new policy. 901 The email identified the number of open correspondent accounts 
with financial institutions in affected countries, including Iran. It also explained: 

"The revised policy does not represent an automatic exit strategy with regards to affected 
clients. Non-USD business (and for Iran, U-turn exempt transactions) may continue to be 
undertaken. . . . Verbal discussions with affected clients would be preferable. Any 
written correspondent seeking to clarify the Group's revised policy should be cleared 
with local Compliance." 902 

Once the policy was in place, HSBC personnel took a closer look at some of the Iranian 
transactions. On August 10, 2005, HBME sales manager Gary Boon sent John Root an email 
which included an excerpt from an email sent by David Bagley to David Hodgkinson. 903 In it, 
Mr. Bagley noted that Mr. Hodgkinson had conveyed that a "significant number" of the trade 
and other transactions involving HBME would be U-turn compliant. In response, Mr. Bagley 
wrote: "I have to say that a number of potential payments resulting from trade transactions from 
other Group offices that John Root and I have looked at since the issuance of the GCL are not in 
our view U-turn compliant." 

In September 2005, HBEU senior payments official Rod Moxley completed an analysis 
of U.K. transactions over a 10-day period that were stopped by the HSBC WOLF filter and 
involved prohibited countries, including Iran. 904 He forwarded the results to senior HSBC Group 
Compliance officials John Root and John Allison, noting that over just ten days, 821 of the 
transactions had involved Iran. 905 



In mid-September 2005, David Bagley provided an update to HSBC Group CEO Stephen 
Green on implementation of the July 2005 GCL. He explained that the "required specialist 'U- 
turn' team" had been established at HBME in Dubai, and a correspondent account with JP 
Morgan Chase had been opened to process compliant U-turn payments. He indicated that 
HBME was also using HBUS to process U-turns, as was HBEU. Mr. Bagley stated that "a 
number of Group Offices" had opened U.S. dollar accounts with HBME for routing Iranian 
payments, but added that he was not convinced that all HSBC affiliates had done so. As a result, 
he issued a reminder to the Regional Compliance Officers to discuss the matter with their 
business heads and requested confirmation by September 23, 2005. 

Despite the issuance of the GCL and the existing arrangement with HBUS, an 
undisclosed Iranian-related transaction was discovered, leading an HBUS executive to believe 
the practice was ongoing. In November 2005, another bank stopped a transaction after HBUS 
had already processed it, without knowing the transaction had involved Iran. HBUS OFAC 
Compliance officer Elizabeth Protomastro notified Mr. Moxley at HBEU that, on November 7, 



901 See 8/25/2005 email from HBUS Alan Ketley to multiple HSBC colleagues, "GCL050047 - Compliance with 
OFAC Sanctions," HSBC OCC 3407565-569. 

902 Id. at 4. 

903 8/25/2005 email from Gary Boon to John Root, HSBC OCC 8876581. See also HSBC OCC 8876580. 

904 See 9/23/2005 email from HBEU Rod Moxley to HSBC John Allison and HSBC John Root, "OFAC sanctions," 
HSBC OCC 8877213-214. 

905 9/23/2005 email from HBEU Rod Moxley to HSBC John Allison and others, "OFAC sanctions," HSBC OCC 
8877213-214. 
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2005, a $100,000 transaction involving Bank Melli had been processed through HBEU's account 
at HBUS without transparent documentation. She wrote: 

"We are bringing this to your attention as this situation indicates that cover payment 
involving Iran are still being processed by PLC [referring to HBEU]. It was our 
understanding that Group payments involving Iran would be fully disclosed as to the 
originators and beneficiaries." 906 

The payment had not been stopped by the HBUS OFAC filter, because it did not contain 
any reference to Iran. She explained that four days later HBUS received a SWIFT message from 
HBEU stating that after contacting the remitter the correct SWIFT should have been 
"MelliRTH94." Since a U.S. bank cannot directly credit an Iranian bank, the payment was 
stopped and rejected by an unrelated bank. However, HBUS did not have the funds because 
Credit Suisse had already been paid through another correspondent bank owned by Credit Suisse. 
Ms. Protomastro explained that if the payment did involve Bank Melli, it met the U-turn 
exception. However, she wanted to know why HBEU continued to submit cover payments 
involving Iran which ran afoul of the new HBUS agreement. 907 Mr. Moxley responded that the 
transaction had uncovered a transparency issue with their payment system, which HBEU would 
work to address. 908 

A later review performed by an outside auditor at HBUS' request found that, even after 
the 2004 HBUS agreement, HSBC affiliates continued to send thousands of undisclosed Iranian 
U-turn transactions through their U.S. dollar accounts at HBUS and elsewhere. The auditor's 
review found that, from July 2002 to June 2005, HBEU and HBME together sent about 18,000 
Iranian U-turn transactions through their U.S. dollar accounts of which about 90% did not 
disclose any connection to Iran. 9 9 The review found that, from July 2005 to June 2006, HBME 
sent about 3,000 Iranian U-turns through its U.S. dollar accounts of which about 95% were 
undisclosed. The comparable figures for HBEU were 1,700 U-turns of which 75% were 
undisclosed. 910 



1 1/23/2005 email from HBUS Elizabeth Protomastro to HBEU Rod Moxley and others, "Cover payment 
processed to Credit Suisse re "Bank Melli" - USD 100,000," HSBC OCC 8876886-887. 

907 Id. 

908 Id. Mr. Moxley explained that when a customer directly inputs a transaction through an approved electronic 
channel, such as Hexagon, and the transaction achieves straight through processing, the cover MT202s are 
automatically generated by the HBEU payments system by the time the transactions hit the HBEU WOLF queue. 
He explained that the WOLF team was reviewing these payments to ensure the U-turn requirements were met, but 
acknowledged the lack of transparency for HBUS and indicated that a paper had already been submitted to the Head 
of Payment Services, Malcolm Eastwood, regarding the matter. Id. 

909 Deloitte Review of OFAC transactions, "March 29, 2012," HSBC OCC 8966113 at 8966143. 

910 Id. at 8966143. The figures for 2005 alone, were that HBEU and HBME together sent about 6,300 Iranian 
payments through U.S. dollar accounts in the United States, of which more than 90% were undisclosed. Id. 
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(h) Shifting Iranian Transactions from HBUS to JPMorgan Chase 
and Back Again 

In 2006, HBME sent a number of Iranian U-turn transactions through its new U.S. dollar 
account at JPMorgan Chase. When JPMorgan Chase decided to exit the business later in the 
year, HBME turned to HBUS to process them. Again, most of the U-turns HBME sent to HBUS 
were undisclosed. 

GCL 060011 Barring Cover Payments. On April 6, 2006, less than a year after GCL 
050047 was issued, HSBC Group issued another Group Circular Letter, entitled "U.S. Dollar 
Payments," essentially barring non-transparent cover payments for most OFAC sensitive 
transactions. It followed an enforcement action by the Federal Reserve Board on December 19, 
2005, charging ABN AMRO Bank with OFAC violations for modifying payment instructions on 
wire transfers used to make OFAC sensitive transactions and using special procedures to 
circumvent compliance systems used to ensure the bank was in compliance with U.S. laws. 911 
About two weeks after the enforcement action, an email exchange among HBEU, HBME, 
HBUS, and HSBC Group Compliance officials revealed: 

"Group compliance is having a closer look at the [2005] GCL, with more specific 
reference to the recently published details of the ABN AMRO Enforcement Action. 
They are considering] whether it is appropriate, for us to move to use of serial payment 

912 

methodology. Group compliance needs to give opinion to Group CEO by next friday." 

That same day, an HBUS Global Payments and Cash Management employee sent an 
email suggesting that commercial U.S. dollar payments be executed as "serial payments in which 
all payment party details are advised through HSBC Bank USA, your USD correspondent." The 
HBUS employee also wrote: "This will allow our automated transaction monitoring system to 
appropriately analyze all group transactions for suspicious activity that would otherwise be 
hidden with the cover payment method. This system goes beyond simple OFAC checking to 
detect repetitive transaction trends indicative of money laundering or terrorist financing. 



911 See 12/19/2005 Federal Reserve Board, Financial Crimes Enforcement Network, Office of Foreign Assets 
Control, New York State Banking Department, and Illinois Department of Financial and Professional Regulation 
press release and Order of assessment of a civil money penalty, 

http://www.federalreserve.gov/boarddocs/press/enforcement/2005/20051219/121905attachment2.pdf. Five years 
later, in May 2010, the Justice Department imposed a $500 million file on ABN Amro for removing information 
from wire transfers involving prohibited countries. See 5/10/2010 U.S. Department of Justice press release, 
http://www.justice.gov/opa/pr/2010/May/10-crm-548.html ("According to court documents, from approximately 
1995 and continuing through December 2005, certain offices, branches, affiliates and subsidiaries of ABN AMRO 
removed or altered names and references to sanctioned countries from payment messages. ABN AMRO 
implemented procedures and a special manual queue to flag payments involving sanctioned countries so that ABN 
AMRO could amend any problematic text and it added instructions to payment manuals on how to process 
transactions with these countries in order to circumvent the laws of the United States. Despite the institution of 
improved controls by ABN and its subsidiaries and affiliates after 2005, a limited number of additional transactions 
involving sanctioned countries occurred from 2006 through 2007."). 

912 1/6/2006 email from HBEU Michele Cros to HBUS Bob Shetty and other HSBC, HBUS, HBEU, and HBME 
colleagues, "OFAC - Compliance with Sanctions GCL," HSBC OCC 7688873. 
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Thiswill assure regulators we are doing everything possible to comply with their 
requirements." 913 

The new GCL 060011 required all HSBC Group affiliates to use fully transparent "serial" 
payments when sending U.S. dollar transactions through HBUS or any other U.S. correspondent, 
with full disclosure of all originators and beneficiaries. 914 Essentially, it required all HSBC 
affiliates to use the same procedure already established at HBUS. The GCL made an exception, 
however, for Iranian U-turns. Instead of requiring full disclosure in the transaction documents 
sent to a U.S. bank, the GCL allowed U-turns to "continue to be made as cover payments." 
HSBC affiliates were required, however, obtain the underlying payment details to ensure the 
transaction was permissible under OFAC regulations. 915 In addition, the GCL required all U- 
turn transactions to continue to be directed through HBME, which had established a dedicated 
team in Dubai for processing Iranian transactions. Because the GCL created an exception for 
Iranian U-turns, it did not stop the use of undisclosed transactions being sent by HBME and 
HBEU to HBUS. 916 



The policy's effective date was April 30, 2006, and directed HBUS to require all third- 
party banks for which it provided U.S. dollar correspondent banking services to utilize the same 

917 

fully transparent payment procedures by December 31, 2006. The GCL also stated that 
dispensations from the deadlines could be obtained only from HSBC Group Compliance, with 
the concurrence of HBUS Compliance. 

Soon after the GCL was announced, several HSBC affiliates requested and received 
dispensation from the April 2006 deadline, the most notable of which ended up giving HBEU 
more than a year to come into compliance with the new GCL. 918 HBEU obtained an initial 



9U 1/6/2006 email from HBUS Richard Boyle to HBEU Michele Cros and HBUS Bob Shetty, "OFAC - 
Compliance with Sanctions GCL," HSBC OCC 7688871 - 873. The email explained that ABN AMRO used their 
"USD nostra [account] with ABN AMRO New York to process USD payments originated through 'special 
procedures'," and that cover payments were used "as a method of masking Iranian and Libyan financial institutions 
as the originators of USD wire transfers." It also discussed the recent regulatory actions as establishing "a precedent 
that the U S entity of a global group will be held responsible for the transactions in USD that may take place any 
where in the Group," and mentioned other banks where regulatory action had been taken, including one that led to a 
cease and desist order prohibiting cover payments. 

914 See "GCL 06001 1 - US Dollar Payments (06/Apr/2006)," HSBC OCC 3407587. 915 The GCL stated that "serial 
payments cannot qualify as U-turn payments," but OFAC confirmed to the Subcommittee that U-turn payments 
could, in fact, be processed as serial payments. Subcommittee briefing by OFAC (5/8/2012). 

915 The GCL stated that "serial payments cannot qualify as U-turn payments," but OFAC confirmed to the 
Subcommittee that U-turn payments could, in fact, be processed as serial payments. Subcommittee briefing by 
OFAC (5/8/2012). 

916 From April through June 2006, about 90% of the Iranian payments sent by HBME to U.S. dollar accounts at 
HBUS and elsewhere did not disclose their connection to Iran. In July 2006, an internal HSBC policy was issued 
that required HBME to send Iranian payments received from Group affiliates to HBUS on a serial basis. After July 
2006, nearly 100% of the Iranian payments sent by HBME to the U.S. disclosed their connection to Iran. This 
internal policy did not apply to HBEU until late in 2007. From April 2006 through December 2007, about 50% of 
the 700 Iranian payments sent by HBEU to U.S. dollar accounts at HBUS and elsewhere did not disclose their 
connection to Iran. Deloitte Review of OFAC transactions, "March 29, 2012," HSBC OCC 89661 13 at 8966143. 

917 4/6/2006 GCL 06001 1, "US Dollar Payments," HSBC OCC 3407587. 

918 See 4/25 - 5/5/2006 email exchanges among HSBC David Bagley, Group offices, and HBEU Rod Moxley, 
"Serial Payments - USD - GCL," HSBC OCC 8877231-239. The emails indicate HSBC Asia Pacific requested 
dispensation for 19 specific countries until August 31, 2006, to allow time to change its payment systems. HBEU 
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dispensation until October 31, 2006. On November 21, 2006, HBEU MPD head Malcolm 
Eastwood requested a second extension until after installation of a new GPS system scheduled 
for July 1, 2007. In July, due to "the huge volume of HBEU traffic and the potential resolution 
of the problem by an impending global system change," HBEU received a third extension until 
November 2007. 919 Since HBEU was one of the top processors of payments for HSBC affiliates, 
its year and a half dispensation delayed full implementation of the new GCL until November 



The month after the new GCL was issued, HBUS Compliance official Anne Liddy sent 
an email to HSBC Group AML head Susan Wright indicating she had heard that David Bagley 
had "issued a dispensation" in relation to the new GCL. Ms. Liddy said that while she recalled 
discussions about how HSBC Group was "having a difficult time getting our Group offices to 
switch (mainly due to systems issues)," and the need to provide more time for clients to convert, 
she did not recall any dispensations being issued. She asked Ms. Wright for more information. 
Ms. Wright responded: "There have been a limited number of dispensations granted re HSBC's 
own customers - John is the keeper of the dispensations and so will provide you with more 
detail." 921 Based on Ms. Liddy' s email, it appears that Group Compliance may have granted 
dispensations which then allowed cover payments to continue, without obtaining HBUS 
Compliance's agreement, as the GCL required. 

JPMC Pulls Out. In May 2006, about six months after HBME opened an account with 
JPMorgan Chase to process Iranian U-turns, JPMorgan Chase decided to stop processing them. 
On May 25, 2006, a JPMC representative informed HBME official Gary Boon that they would 
continue to process HBME's dollar payment transactions, with the exception of Iranian 

922 

transactions that reference details in the payment narrative. On May 26, 2006, Mr. Bagley 
wrote to HSBC Group CEO Stephen Green that "JMPC have indicated that they are not willing 
to process these payments, I assume for reputational rather than regulatory reasons (given that 
they are within the U-turn exemption)." He continued that HBME would have to "pass these 
payments through HBUS." He noted that they had previously received concurrence from HBUS 
to process the transactions, confirmed by HBUS CEO Martin Glynn. 923 That same day Mr. 



requested a dispensation until the end of October 2006 for MPS, citing a reconfiguration of the new GPP system that 
was expected by December 31, 2006. Michael Grainger in GTB - PCM, in conjunction with Operations and IT, 
requested a dispensation for HBEU sites through HUB until the end of 2006 to allow system changes to be 
implemented and piloted. David Bagley forwarded this email correspondence to John Allison with a request for 
consideration. He also noted that the serial methodology would put HBEU at a competitive disadvantage with 
regard to fees charged and the volume of customer complaints. Id. 

919 7/4/2007 email from HBEU Rod Moxley to IBEU Tony Werby and Andy Newman, "[redacted] - HSBC 
arrangements for payment of the consideration," HSBC OCC 8876901. 

920 A Deloitte review later determined that HBEU continued to send U-turns without any reference to Iran through 
the end of 2007, reflective of the dispensation granted to HBEU until November 2007. Deloitte Review of OF AC 
transactions, "March 29, 2012," HSBC OCC 89661 13 at 8966143. See also 1 1/21/2006 memorandum from HBEU 
Malcolm Eastwood to HSBC David Bagley and others, "GCL 06001 1 Dispensation," HSBC OCC 8876896-899. 

921 See 7/16 - 25/2007 email exchanges among HBUS Anne Liddy, HSBC Susan Wright, and HSBC John Allison, 
"Conversion of Clients to Serial Payment Method," HSBC OCC 8875256. 

922 5/25/2006 email from JPMC Ali Moosa to HBME Gary Boon and others, "US Dollar Transactional Activities via 
DDA at JPM," HSBC OCC 3243782-787 at 786. . 

923 5/26/2006 email from HSBC David Bagley to HSBC Stephen Green, "US Dollar Transactional Activities via 
DDA at JPM," HSBC OCC 3243782-787 at 784. 
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Bagley alerted HBUS AML head Teresa Pesce that "HBME have no choice but to now pass" U- 
turn exempt payments through HBUS. 924 

Iranian Transactions Shift to HBUS. HBUS was already processing Iranian U-turn 
transactions for HBEU, but HBME' s decision to route its Iranian U-turns through HBUS as well 
represented an increase in the volume of transactions that HBUS would have to identify and 
review. 



On May 26, 2006, the same day he learned HBME would begin routing U-turns through 
its U.S. dollar account at HBUS, HBUS AML officer Alan Ketley emailed HBME's Alan Kerr 

925 

to clarify how HBUS would process the new volume of payments. On May 30, 2006, Mr. 
Ketley wrote to HBME Gary Boon, copying HBUS AML head Teresa Pesce: "I'm unclear why 
you would be seeking to have HBUS handle this activity at no notice and am uncomfortable 
making arrangements for such sensitive activity in this fashion." He requested examples of 
payment orders for routing through HBUS and asked for confirmation that HBME would not 
begin routing U-turns through HBUS until they had the "appropriate controls in place." He was 
also concerned from a resource perspective, and stated that HBME intended to pass as many U- 
turns in a day as HBUS would normally handle in a busy month. 926 That same day, in response 
to his email to Mr. Boon, Ms. Pesce wrote: "Alan - we have no choice. JPMC won't take 



HBUS' effort to ensure it had adequate staffing to review OFAC -related alerts from the 
HBME U-turns was made more difficult by varying information from HBME on the number of 
transactions to expect. On June 22, 2006, HBUS Compliance officials Anne Liddy and Alan 
Ketley reacted to an email exchange involving HBME's Gary Boon discussing U-turn payment 
volumes being processed through HBUS as between 10 and 25 per day. Ms. Liddy wrote: 

"[B]efore it was about 40. Yesterday 10. Now 25ish. BTW I am going to set up a 
m[ee]t[in]g with Terry and Denise (as our financier) to discuss resourcing for OFAC. It 
is out of hand." 928 



In July 2006, HBME made a policy decision to go beyond the requirements of the Group- 
wide 2006 GCL and require all of its Iranian transactions to provide fully transparent payment 
information to its U.S. correspondents. 929 

In addition to the HBME transactions moving to HBUS, one other notable transaction 
involving Iran in 2006, pertained to 32,000 ounces of gold bullion valued at $20 million. In May 
2006, the HBUS London branch cleared the sale of the gold bullion between two foreign banks 



924 5/26/2006 email from HSBC David Bagley to HBUS Teresa Pesce and others, HSBC OCC 3243782-783. 

925 5/26/2006 email from HBUS Alan Ketley to HBME Alan Kerr and HBME Gary Boon, "U-Turns," OCC-PSI- 
00179654 

926 5/30/2006 email from HBUS Alan Ketley to HBME Gary Boon and HBME Alan Kerr, "U-Turns," OCC-PSI- 
00179654. 

927 5/30/2006 email from HBUS Teresa Pesce to HBUS Alan Ketley, "U-Turns," HSBC OCC 3243965. 

928 6/22/2006 email from HBUS Anne Liddy to HBUS Alan Ketley, "You Turn Payments," HSBC OCC 3250730- 
732. 

929 Subcommittee briefing by Cahill Gordon & Reindel LLP (6/20/2012) 
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for the ultimate benefit of Bank Markazi, Iran's Central Bank. HSBC indicated that it had been 
aware that Bank Markazi was the beneficiary, but had viewed the transaction as a permissible U- 
turn. OFAC later told HBUS that it considered the transaction to be a "non-egregious" 
violation of law, and provided HBUS with an opportunity to explain why it should not be 

no i 

penalized for it; HBUS is still awaiting a final determination as to whether it will be penalized, 
(i) Getting Out 

In October 2006, HSBC Group reversed course and decided to stop handling Iranian U- 
turns. In 2007, it went further and exited all business with Iran, subject to winding down its 
existing obligations. 

Increasing Risks. In October 2006, Mr. Bagley provided a warning to his superiors that 
HSBC might want to re-consider processing U-turns. In an email on October 9, 2006, Mr. 
Bagley informed Stephen Green, who had become HSBC Group Chairman, Michael Geoghegan, 
who had become HSBC Group CEO, and David Hodgkinson, who used to head HBME but had 
become HSBC Group COO, that the risks associated with U-turns had increased due to "actions 
taken by the US government in withdrawing the U-Turn exemption from Bank Saderat." The 
prior month, in September 2006, HBUS had stopped an undisclosed transaction involved Bank 
Saderat in Iran, which was added to the OFAC SDN list that same month. 933 

Mr. Bagley wrote: 

"During my recent visit to the US to attend a Wolfsberg meeting I was discretely advised 
of the following by a reliable source: 

[U.S. Treasury] Under Secretary [Stuart] Levey ... and the more hawkish elements within 
the Bush administration were in favour of withdrawing the U-Turn exemption from all 
Iranian banks. This on the basis that, whilst having direct evidence against Bank Saderat 
particularly in relation to the alleged funding of Hezbollah, they suspected all major 
Iranian State owned banks of involvement in terrorist funding and WMD [weapons of 
mass destruction] procurement. . . . 

Certain US Government bodies have however made it known to a number of US banks 
that, as WMD related transactions are impossible to detect they would run an 
unacceptable reputational and regulatory risk were they to continue to process U-Turn 
transactions. The essence of the statement appears to be that as WMD related 
transactions would be heavily disguised (where even as a trade transaction documents 



93,1 1/1/2010 - 5/31/2010 Compliance Certificate from HSBC David Bagley to HNAH Brendan McDonagh and Niall 
Booker, OCC-PSI-0 1754 176, at 17. 

931 See draft HSBC response to pre-penalty notice, OCC-PSI-00299323. 

932 10/9/2006 email from HSBC David Bagley to HSBC Stephen Green, HSBC Michael Geoghegan, and HBME 
David Hodgkinson, "Iran - U-Turn Payments," HSBC OCC 8874731-732. 

933 See 9/1 1/2006 email from HBUS Anne Liddy to HBUS Teresa Pesce, "HBME Wire payment USD 586.00 (Iran- 
Bank Saderat) - Reject & Report to OFAC," HSBC OCC 4844209 and 12/14/2006 email from Elizabeth 
Protomastro to John Allison and others, "OFAC - Wire payments blocked from HSBC offshore entities - USD 
32,000 (re SDGT) and USD 2,538,939.33 (re Sudan)," HSBC OCC 3407608-609. 
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would in effect be falsified) there is no safe way for a US bank to be involved in even a 
U-turn exempt transaction however stringent the scrutiny or monitoring. The clear 
implication made was that being found to be involved in a WMD related transaction, 
even if wholly innocently, would result in significant and severe action being taken 
against such a bank. 

There were very strong indications that a number of US banks were therefore considering 
withdrawing from all U-turn related activity. If this happens those continuing in this 
market are likely to have an increased concentration. 

Although I am satisfied that we have put appropriate controls in place to manage the U- 
Turn transactions, I am concerned that there are now increased risks in continuing to be 
involved in U-Turn USD payments which would justify our reconsidering our approach. 
I do recognize that the significance that tightening our policy to withdraw from U-Turn 
permitted transactions would have in terms of our Middle Eastern and Iranian 
business." 934 

GCL 060041 Ending U-turns. Shortly after Mr. Bagley's email, HSBC decided to stop 
processing U-turns entirely. On October 25, 2006, HSBC Group Compliance issued Group 
Circular Letter 060041 which directed all Group offices to immediately stop processing U-turn 

QIC 

payments. An exception was made for permissible U-turn payments in connection with 
legally binding contractual commitments. HSBC decided to stop utilizing the U-turn exception 
two years before OFAC actually revoked the exception in November 2008. 

Despite this decision, HSBC maintained a number of existing Iranian relationships. 936 
On March 13, 2007, as a result of a "letter recently filed with the SEC "relating to the extent of 
our exposure to business in the so-called named countries (Sudan, Syria, and Iran)," 937 HSBC 
Group Compliance head David Bagley updated HSBC Group CEO Michael Geoghegan on 
HSBC's relationships with Iranian banks. He wrote: 

"The existing levels of business, much of which is historic and subject to ongoing 
commitments, has been reviewed by CMP [Compliance] as against the requirements of 
Group policy, particularly where transactions are denominated in USD. Some of this 
activity related to pre-existing committed obligations which are binding on an ongoing 
basis. Group policy recognizes that we will have to allow such arrangements to run off. 
Relevant business colleagues are however aware of the Group's stance in terms of having 
no appetite for new or extended business activity involving Iranian counterparties. 
Where transactions appear to potentially conflict with Group policy those transactions are 
referred to GHQ CMP for determination and sign-off." 938 



934 Id. at 8874732. 

935 10/25/2006 GCL 060041, "US OFAC Sanctions against Iran - U-Turn Exemption," HSBC OCC 3407606. 

936 See 2/6/2006 Project and Export Finance presentation, "Iranian portfolio," HSBC OCC 8876050-057. This 
presentation indicated that Project and Export Finance had not taken on any new Iranian business since 2005. 

937 3/13/2007 email from HSBC David Bagley to HSBC Michael Geoghegan and others, "Iran," HSBC OCC 
8878037-038. 

938 Id. at 8878037-038. 
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The subject of Iran arose again a few months later, in June 2007, when Mr. Bagley 
informed HSBC Group CEO Michael Geoghegan that he had a private meeting with U.S. 
Treasury Under Secretary for Counter Terrorist Financing and Sanctions, Stuart Levey, during a 
recent Wolfsberg Group conference. Mr. Bagley indicated that Mr. Levey had questioned him 
about a HSBC client who, according to Mr. Levey, "had clearly been identified as having acted 
as a conduit for Iranian funding of an entity whose name was redacted from the document by 
HSBC. 939 Mr. Bagley wrote: "Levey essentially threatened that if HSBC did not withdraw from 
relationships with [redacted] we may well make ourselves a target for action in the US." Mr. 
Geoghegan responded: "This is not clear to me because some time ago I said to close this 
relationship other than for previously contractually committed export finance commitments." 940 
Mr. Bagley replied that the bank had only "limited relationships with [redacted] and in fact 
overall with Iranian banks." 

Mr. Bagley also wrote that he had discussed the matter with David Hodgkinson, and they 
agreed that HSBC "should immediately withdraw from [redacted] and also withdraw from all 
Iranian bank relationships in a coordinated manner." He noted that the bank would have to 
honor "legally binding commitments" such as Project and Export Finance facilities. 941 These 
communications indicate that HSBC officials had previously known about problems with one 
particular Iranian client but that it did not end the relationship until after a warning from the U.S. 
government. 

GCL 070049 on Exiting Iran. On September 24, 2007, HSBC Group Compliance 
issued another Group Circular Letter, this one announcing the bank's decision to exit Iran. GCL 
070049 directed all account relationships with Iranian banks to be "closed as soon as possible" 
with sufficient notice as required by local law and to "allow an orderly run down of activity" and 
the "run-off of any outstanding exposures." The GCL allowed ongoing payments involving 
existing facilities and transactions "where there are legally binding commitments," such as 
Project and Export Finance facilities, to continue to be made as serial payments. 942 The deadline 
for closure of all Iranian accounts was November 30, 2007. 

2008 and 2009 Iranian Transactions. After the GCLs terminating most business with 
Iran, internal bank documents show that hundreds of Iranian transactions per month continued to 
surface at HBUS during 2008 and 2009. These transactions were not, however, the type of 
undisclosed U-turn transactions that HSBC affiliates had been routinely sending through HBUS 
accounts prior to HSBC's decision to exit Iran, but represented other types of transactions. 

In 2008 and 2009, for example, HBUS' London Banknotes office conducted a series of 
apparently prohibited transactions benefitting the Iranian Embassy in London. From July 22, 
2008 to February 12, 2009, in more than 30 transactions, HBUS sold over €455,000 to HBEU 



See 6/8/2007 email exchanges among HSBC David Bagley, HSBC Michael Geoghegan and others, "Iran," 
HSBC OCC 8878214-216 at 215. 

940 Id. at 8878215. 

941 Id. at 8878214. 

942 9/24/2007 GCL 070049, "Sanctions Against Iran," OCC-PSI-00141529-531 and HSBC OCC 8876013-015. 
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which, in turn, sold them to the Embassy of Iran in the United Kingdom. According to 
HBUS, "the funds were used to meet salary obligations" of the Iranian Embassy. 944 In addition, 
from December 5, 2008 to February 5, 2009, HBEU purchased over $2,500 from the Embassy of 
Iran and resold the U.S. dollars to HBUS. 945 In 2009, after HBUS discovered that the London 
Banknotes office was engaging in currency transactions with the Iranian Embassy, it reported the 
transactions to OFAC and ended the activity. 946 

Other transactions involving Iran processed through HBUS' correspondent accounts from 
2008 to 2009, included a March 2009 wire transfer for $300,000, which was mistakenly 
processed because a HBUS compliance officer did not realize a transaction reference to "Persia" 
implied a connection to Iran; and two wire transfers totaling over $55,000 which involved a 
vessel owned by "NITC" which, until it was updated, HBUS' OFAC filter did not recognize as 
the National Iranian Tanker Company. 947 



(j) Looking Back 

According to an ongoing outside audit requested by HSBC, from 2001 to 2007, HBEU 
and HBME sent through their U.S. dollar accounts at HBUS and elsewhere nearly 25,000 OFAC 
sensitive transactions involving Iran totaling $19.4 billion. 948 While some of those transactions 
were fully disclosed, most were not. According to the review conducted by Deloitte, from April 
2002 to December 2007, more than 85% of those payments were undisclosed. 949 



Despite HBUS pleas for transparency and a 2004 internal agreement to use fully 
transparent procedures, HSBC affiliates HBEU and HBME often took action, including by 
deleting references to Iran or using cover payments, to prevent the Iranian transactions sent 
through their U.S. dollar correspondent accounts at HBUS from being caught in the OFAC filter. 
Despite the fact that they viewed most of the transactions as permissible under U.S. law, 
concealing their Iranian origins helped avoid delays caused when HBUS' OFAC filter stopped 
the transactions for individualized review. HBME, in particular, requested that HBUS allow the 
use of cover payments to conceal Iranian transactions and circumvent the OFAC filter. When 
HBUS insisted on fully transparent transactions, the HSBC affiliates sent undisclosed 
transactions through their HBUS accounts anyway. HSBC Group leadership, including the 



94J 3/20/2009 letter from HBUS Elizabeth Protomastro to OFAC, HSBC OCC 060892. See also 1/25/2012 OCC 
Supervisory Letter HSBC-2012-03, "OFAC Compliance Program," OCC-PSI-0 176856 1-566, at Attachment 
(describing the transactions as involving over $606,000 in U.S. dollars). [Sealed Exhibit.] 

944 Id. 

945 Id. 

946 See 3/24/2009 "Compliance Report for 1Q09-HUSI Businesses," sent by HBUS Lesley Midzain, to HNAH Janet 
Burak, HSBC David Bagley, and HBUS Paul Lawrence, HSBC OCC 3406981; 1/25/2012 OCC Supervisory Letter 
HSBC-2012-03, "OFAC Compliance Program," OCC-PSI-0 176856 1-566, at Attachment. [Sealed Exhibit.]. 

947 See 1/25/2012 OCC Supervisory Letter HSBC-2012-03, "OFAC Compliance Program," OCC-PSI-0 1768561- 
566, at Attachment. [Sealed Exhibit.] 

948 See Deloitte Review of OFAC transactions, "Results of the Transactions Review - UK Gateway, March 29, 
2012," HSBC-PSI-PROD-0197919, at 930. 

949 Subcommittee briefing by Cahill Gordon & Reindel LLP (6/20/2012); Deloitte presentation, "March 29, 2012," 
at HSBC OCC 89661 13. These payments were sent to the U.S. bank as cover payments, serial payments, or 
payments that were cancelled and then re-submitted by either an HSBC affiliate or the client without disclosing the 
connection to Iran in the payment message. Id. at 89661 18 and 8966143. 
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heads of Compliance and AML, were aware in varying degrees of what the affiliates were doing, 
but for years, took no steps to insure HBUS was fully informed about the risks it was incurring 
or to stop the conduct that even some within the bank viewed as deceptive. The HSBC Group 
Compliance head took no decisive action even after noting that the practices "may constitute a 
breach" of U.S. sanctions. At HBUS, senior executives in the Compliance and payments areas 
knew about the actions being taken by HSBC affiliates to send concealed Iranian transactions 
through their U.S. dollar correspondent accounts, but were unable or unwilling to obtain 
information on the full scope of the problem, bring the issue to a head, and demand its resolution 
at the highest levels of the bank to ensure all U-turns were reviewed for compliance with the law. 

(2) Transactions Involving Other Countries 

Iranian transactions were not the only potentially prohibited transactions sent through 
HBUS. Transactions involving Burma, Cuba, North Korea, and Sudan, as well as persons 
named on the SDN list, were also sent through HBUS accounts, although to a much lesser extent 
than those related to Iran. HSBC affiliates were one major source of the transactions, due to 
poor compliance with HSBC Group policy barring U.S. dollar transactions with prohibited 
countries or persons, and requiring transparent transactions, but the majority of these transactions 
appear to have been sent through HBUS by unrelated financial institutions. The transactions sent 
by HSBC affiliates also do not appear to be the product of the same kind of systematic effort to 
avoid the OFAC filter as was the case with the Iranian U-turns. Some of the transactions sent 
through HBUS had references to a prohibited person or country deleted or used cover payments, 
and passed undetected through the OFAC filter. Others openly referenced a prohibited country 
or person, but escaped detection by HBUS' OFAC filter or HSBC's WOLF filter due to poor 
programming. Still others were caught by a filter, but then released by HBUS personnel, 
apparently through human error. An ongoing review by an outside auditor, examining HBUS 
transactions over a seven-year period from 2001 to 2007, has so far identified about 2,500 
potentially prohibited transactions involving countries other than Iran, involving assets totaling 
about $322 million. 950 

(a) 2005 and 2006 GCLs 

The documents examined by the Subcommittee show that HBUS' OFAC filter blocked a 
transaction involving a prohibited country other than Iran as early as 2002. 1 Internal bank 
documents indicate, however, that transactions involving prohibited persons or countries other 
than Iran did not receive the same level of attention as the Iranian transactions, until issuance of 



Deloitte presentation, "Results of the Transactions Review - UK Gateway, March 29, 2012," HSBC-PSI-PROD- 
0197919, at 930. Since the Deloitte review has yet to examine an additional set of U.S. dollar transactions and does 
not include any transactions during the period 2008 to 2010, its figures represent a conservative analysis of the 
potentially prohibited transactions transmitted through HBUS. 

951 On May 21, 2002, a $3 million payment from HBEU was blocked by HBUS' OFAC filter due to a reference in 
the payment details to Cuba. See 4/24/2006 email from HBUS Charles Delbusto to HBUS Michael Gallagher, 'TNG 
Writeup," HSBC OCC 1933599-601. See also 11/14/2002 memorandum from HBEU Malcolm Eastwood to HBUS 
Denise Reilly and HBEU Geoff Armstrong, "Compliance - OFAC Issues in General and Specific to Iran," HSBC 
OCC 7688824. 
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the July 28, 2005 Group Circular Letter 050047 which barred HSBC affiliates from executing 
U.S. dollar transactions involving any person or country prohibited by OFAC. 952 

Shortly after the GCL was issued, the HSBC Group head of Global Institutional Banking, 
Mark Smith, issued a managerial letter, in August 2005, providing guidance on implementing the 
new policy. His letter summarized the Group's relationships with Burma, Cuba, Iran, North 
Korea, Sudan, and Zimbabwe. He explained that most of HSBC Group's business with Sudan 
and Cuba was conducted in U.S. dollars and "discussions already initiated with the affected 
banks will dictate the extent of our ongoing relationship." The guidance also clarified that the 
revised policy applied only to U.S. dollar transactions. 54 

In addition, the managerial letter identified correspondent relationships affected by the 
new policy. 955 It provided the number of open correspondent accounts with financial institutions 
in Cuba, Burma, Iran, North Korea and Sudan. It also explained: 

"The revised policy does not represent an automatic exit strategy with regards to affected 
clients. Non-USD business (and for Iran, U-turn exempt transactions) may continue to be 
undertaken. However, for a number of reasons eg. operational simplicity, where the 
remaining non-USD business is uneconomic or where the client concludes they will have 
to conduct their business with an alternative provider, the ultimate outcome may be the 
closure of certain relationships. Verbal discussions with affected clients would be 
preferable. Any written correspondent seeking to clarify the Group's revised policy 
should be cleared with local Compliance." 956 

The letter noted that "any dispensation from the terms of the GCL require[d] Group Compliance 
concurrence." 957 

In September 2005, senior HBEU payments official Rod Moxley completed an analysis 
of U.K. transactions over a 10-day period that were stopped by HSBC's WOLF filter and 
involved Burma, Cuba, or Sudan. 95 He forwarded the results to senior HSBC Group 
Compliance officials John Root and John Allison, noting that there were "a considerable number 
of USD denominated transactions" for Sudan, and "also to a lesser extent" Cuba and Burma. He 
also noted that prior to the effective date of the new GCL, these payments would have been 
stopped by the WOLF filter but then allowed to proceed, "providing they did not infringe on 
UN/EU sanctions or terrorist parameters," since HBEU was "not affected directly by OFAC 
sanctions," but the new GCL would require these payments to be blocked due to OFAC 
prohibitions. 



9i2 7/28/2005 GCL 050047, "Compliance with Sanctions," HSBC OCC 3407560-561. 

953 8/25/2005 managerial letter from HSBC Mark Smith to HBUS Aimee Sentmat, HBME Alan Kerr, and others, 
"GCL050047 - Compliance with OFAC sanctions," HSBC OCC 3407565-569. 

954 Id at 3407566. 

955 Id. 

956 Id. at 3407568. 

957 Id. at 3407568. 

958 See 9/23/2005 email from HBEU Rod Moxley to HSBC John Allison and HSBC John Root, "OFAC sanctions," 
HSBC OCC 8877213-214. 
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Mr. Moxley also wrote: 



"Since the issuance of the GCL, it has been made clear that US interests are of paramount 
importance and we should do nothing, when processing payment transactions, which 
would leave HBUS in a vulnerable position. The issues surrounding Iran have 
overshadowed other OFAC payments recently, however, I can advise that we have not so 
far physically returned any USD payments involving Sudan, Cuba or Burma. I feel we 
now need to look far more closely at these payments to ensure compliance with the 



Mr. Moxley asked about two alternative responses to transactions stopped by the WOLF 
filter and barred by the new GCL. One was to continue processing the transactions but ensure 
that the payment was routed in such a way "that they are not frozen in the US." He explained: 
"This will involve intelligent usage of the routing system but may perpetuate similar scenarios to 
those encountered with Iran (customer instructions saying Do not mention Sudan or routing 
which does not make it apparent that these are Sudanese payments)." This alternative seems to 
suggest that HSBC would engage in Iran-style transactions in which transaction details are 
stripped out to avoid triggering the OFAC or WOLF filters. His second alternative was to 
"strictly" apply the GCL "and return the payments unprocessed." He wrote that his "instinct" 
was to "return all such USD payments ... so that our US colleagues' position is not 
compromised," but wanted confirmation from HSBC Group Compliance before taking that 
action. 960 The documents reviewed by the Subcommittee do not indicate what response he 
received. When asked about his email, Mr. Moxley told the Subcommittee that he could not 
recall how his inquiry was resolved. 961 

About a year later, on April 6, 2006, HSBC Group issued another Group Circular Letter, 
GCL 060011, which required all HSBC affiliates, when sending U.S. dollar transactions through 
a correspondent account at HBUS or another U.S. financial institution to use so-called "serial 
payments" specifying the transaction's chain of originators and beneficiaries. 962 This policy 
change was intended to stop HSBC affiliates from using cover payments, which provide less 
information for banks when processing payments and which can mask potentially prohibited 
transactions sent through HBUS or other U.S. banks. Its effective date for HSBC affiliates was 
April 30, 2006; HBUS was required to impose the policy on all third-party banks for which it 
provided U.S. dollar correspondent banking services by December 31, 2006. 963 At the same 
time, HSBC Group Compliance granted a year-long extension to HBEU, giving it until July 
2007, before it was required to use serial payment instructions. 964 

Internal bank documents indicate that OFAC sensitive transactions involving countries 
other than Iran took place both before and after the 2005 and 2006 GCLs. 



959 Id. 

960 Id. at 8877214. 

961 Subcommittee Interview of Rod Moxley (6/7/2012). 

962 4/6/2006 GCL 060011, "US Dollar Payments," HSBC OCC 3407587. 

963 Id. 

964 See 4/25 - 5/5/2006 email exchanges among HSBC David Bagley, Group offices, and HBEU Rod Moxley, 
"Serial Payments - USD - GCL," HSBC OCC 8877231-239. Subcommittee briefing by OFAC (5/8/2012). 
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(b) Transactions Involving Cuba 

Internal bank documents indicate that, from at least 2002 through 2007, HBUS processed 
potentially prohibited U.S. dollar transactions involving Cuba. HSBC affiliates in Latin 
America, in particular, had many Cuban clients and sought to execute transactions on their behalf 
in U.S. dollars, despite the longstanding, comprehensive U.S. sanctions program and the OFAC 
filter blocking such transactions. 965 

In August 2005, a month after HSBC Group issued its new GCL policy barring HSBC 
affiliates from engaging in U.S. dollar transactions in violation of OFAC prohibitions, HBUS 
circulated an email identifying correspondent relationships that would be affected. 966 The email 
stated: "An overriding observation is that the revised policy will most significantly impact the 
Cuban and Sudan correspondent bank relationships." It also observed: "For Sudan and Cuba, 
most of our business is conducted in USD and the discussions already initiated with the affected 
banks will dictate the extent of our ongoing relationships." 967 

In September 2005, HSBC Group Compliance head David Bagley told HSBC Group 
CEO Stephen Green that they had closed "a number of USD correspondent relationships with 
Cuban . . . banks." 968 On October 3, 2005, Mr. Bagley sent an email to Matthew King, then head 
of HSBC Group Audit, that Mr. Green was "particularly concerned" about ensuring the 2005 
GCL was "properly and fully implemented across the Group." 969 Mr. Bagley asked Mr. King to 
use HSBC's internal audits to help gauge compliance with the new GCL. Mr. King relayed the 
request to various HSBC auditors and, in response, learned from HSBC Mexico (HBMX) 
Compliance that the OFAC list had not been fully integrated into HBMX's monitoring system 
and would not be for another six months, until April 2006. 970 HBMX reported that, pending the 
systems integration, it had set up "manual controls" in several divisions to implement the new 
GCL, but "no automated means exists to ensure that these controls are properly being carried 

97 1 

out." HBMX explained further that its "greatest exposure" was "the volume of business 
historically carried out by HBMX customers with Cuba in US dollars." 972 

Mr. King responded that the HBMX transactions raised two sets of concerns, one with 
respect to the U.S. dollar transactions involving Cuba being run through HBMX's correspondent 
account at HBUS, and the second with respect to non-U. S. dollar transactions being "transmitted 
through the HBUS TP gateway," referring to a U.S. -based server that handled transfers from 



See OFAC "Sanctions Programs and Country Information," Cuba sanctions (last updated 5/1 1/2012), 
http://www.treasury.gov/resource-center/sanctions/Programs/pages/cuba.aspx. 

966 See 8/25/2005 email from HBUS Alan Ketley to multiple HSBC colleagues, "GCL050047 - Compliance with 
OFAC Sanctions," HSBC OCC 3407565-569. 

967 Id. at 3407568. 

968 9/19/2005 email from HSBC David Bagley to HSBC Stephen Green and HSBC Richard Bennett, "GCL050047 
"Compliance With Sanctions," HSBC OCC 8874360-362. 

969 10/3/2005 email from HSBC David Bagley to HSBC Matthew King, "GCL 050047 - Compliance with 
Sanctions," HSBC OCC 8874359-360. 

970 10/14/2005 email from HBMX Graham Thomson to HSBC Matthew King, "GCL 050047 - Compliance with 
Sanctions," HSBC OCC 8874358-359. 
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Mexico and South America. Since the United States prohibited transactions involving Cuba, 
both types of transactions raised questions about whether they ran afoul of the OFAC list and the 
2005 GCL. Mr. King responded: 

"I note HBMX continues to process USD payments involving Cuba. It is very important 
that is stopped immediately as the regulators are getting very tough and the cost to the 
Group could be considerable if a breach occurs, both in terms of the fine and the 
rectification work which is likely to be a pre-requisite to any settlement. 

With regard to non-USD payments as described above, GHQ CMP [Group Headquarters 
Compliance] are urging HBUS to screen out these transactions to avoid any risk, and 
HBMX would have to put measures in place to p[re]-empt customer dismay." 974 

HSBC affiliates from outside of Latin America also occasionally sent potentially 
prohibited transactions involving Cuba through their HBUS accounts. For example, in 
December 2006, a payment for $15,350 that had been sent by an HSBC affiliate in the Asia- 
Pacific region was blocked by HBUS, because the transaction documents referred to "Air Tickets 
Moscow Havana Moscow 3Pax." 975 

In 2007, an internal HSBC document entitled, "Information Requested in Connection 
With: (North Korea, Cuba, and Myanmar)," revealed that, as of May 2007, HSBC affiliates in 
Mexico and Latin America were still providing U.S. dollar accounts to Cuban clients, in apparent 
violation of HSBC Group GCL policy and OFAC regulations. 976 The document indicated that 
HBMX had 23 Cuban customers with U.S. dollar accounts containing assets in excess of 
$348,000, and 61 Cuban customers holding both U.S. dollar and Mexican peso accounts with 
assets totaling more than $966,000. 977 In addition, the report disclosed that HSBC affiliates in 
Colombia, Costa Rica, El Salvador, Honduras, and Panama were also providing U.S. dollar 
accounts to Cuban nationals or the Cuban Embassy. The document also indicated that 
arrangements had been made to "cancel all business relationships with" Cuban clients, in relation 
to U.S. dollar accounts or commercial relationships for the entire region. These steps were 
being taken almost two years after the July 2005 GCL had prohibited HSBC affiliates from 
executing U.S. dollar transactions involving OFAC sensitive persons. 



973 10/17/2005 email from HSBC Matthew King to HBMX Graham Thomson, HSBC David Bagley, and others, 
"GCL 050047 "Compliance With Sanctions," HSBC OCC 8874357-358. 

974 Id. 

975 12/17/2006 email from HBAP Donna Chan to HBUS Alan Ketley and others, "TT NSC770937 Dated 13Dec06 
For USD15,350.21," HSBC OCC 3287261-262. 

976 5/18/2007 HSBC document, "Information Requested in Connection With: (North Korea, Cuba, and Myanmar)," 
HSBC OCC 8876088-095, at 8876093-095. 

977 Id. In addition, 1, 284 Cuban clients had 
exceeding a total of $8.9 million. Id. at 8876093. 

978 5/18/2007 HSBC report, "Information Re 
HSBC OCC 8876088-095 at 8876093-095. 



977 Id. In addition, 1, 284 Cuban clients had nearly 2250 HBMX accounts holding solely Mexican pesos, with assets 
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(c) Transactions Involving Sudan 

A second set of OFAC sensitive transactions involved Sudan, a country which is also 
subject to a comprehensive sanction program in the United States. 979 Internal bank documents 
indicate that, from at least 2005 to 2008, HBUS processed a considerable volume of U.S. dollar 
transactions involving Sudan that, once the new GCL took effect, should have decreased. The 
reasons they continued include a wide range of factors, from inadequate bank staffing reviewing 
OFAC transactions, to deceptive wire transfer documentation, to ongoing actions by HSBC 
affiliates to send these potentially prohibited transactions through HBUS. 

In August 2005, a month after HSBC Group issued the GCL policy barring HSBC 
affiliates from engaging in U.S. dollar transactions in violation of OFAC prohibitions, HSBC 
Group head of Global Institutional Banking, Mark Smith, circulated a managerial letter 
identifying correspondent relationships that would be affected. 980 The letter stated: "An 
overriding observation is that the revised policy will most significantly impact the Cuban and 
Sudan correspondent bank relationships." It also observed: "For Sudan and Cuba, most of our 
business is conducted in USD and the discussions already initiated with the affected banks will 

no 1 

dictate the extent of our ongoing relationships." In September 2005, a senior HBEU payments 
official Rod Moxley completed an analysis of U.K. transactions over a 10-day period that were 
stopped by the WOLF filter and noted "a considerable number of USD denominated 
transactions" for Sudan. 982 

A year after the GCL took effect, however, one affiliate attempted to clear a Sudan- 
related transaction through HBUS in violation of company policy. On December 6, 2006, HBUS 
blocked a $2.5 million payment originating from an HSBC branch in Johannesburg, because the 
payment details referenced the "Sudanese Petroleum Corporation." Although the payment 
had also been stopped by the WOLF filter in HSBC Johannesburg, an employee there had 
approved its release and sent the transaction through their correspondent account at HBUS. An 
internal email from HSBC Johannesburg explained that the release of the funds was: 

"a genuine error in an attempt to push the day[']s work through before the cut-off time. I 
believe the loss of three staff in the department leaving only two permanent staff 
remaining is causing the[m] to work towards clearing their queues rather than slow down 



See OFAC "Sanctions Programs and Country Information," Sudan sanctions (last updated 2/1/2012), 
http://www.treasury.gov/resource-center/sanctions/Programs/pages/sudan.aspx . 

980 8/25/2005 managerial letter from HSBC Mark Smith to HBUS Aimee Sentmat, HBME Alan Kerr, and others, 
"GCL050047 - Compliance with OFAC sanctions," HSBC OCC 3407565569; 8/25/2005 email from HBUS Alan 
Ketley to multiple HSBC colleagues, "GCL050047 - Compliance with OFAC Sanctions," HSBC OCC 3407565- 
569. 

981 Id. at 3407568. 

982 See 9/23/2005 email from HBEU Rod Moxley to HSBC John Allison and HSBC John Root, "OFAC sanctions," 
HSBC OCC 8877213-214. 

983 See 12/14/2006 email from HBUS Elizabeth Protomastro to HBUS John Allison and others, "OFAC - Wire 
payments blocked from HSBC offshore entities - USD 32,000 (re SDGT) and USD 2,538,939.33 (re Sudan)," 
HSBC OCC 3407608-609. 



172 



to read the warnings such as these. . . . Having said that I also feel it is a matter of 
training where seeing the word 'Sudan' alone should have been warning enough." 984 

The email also noted that the transaction had been sent by Commercial Bank of Ethiopia, which 
was "aware that this payment may not go through as they have attempted to make this payment 
via their other correspondent banks and failed." 985 

In July 2007, HBUS discovered that another client, Arab Investment Company, had been 
sending "multiple Sudan-related payments" through its U.S. dollar account at HBUS, that other 
banks later blocked for specifying a Sudanese originator or beneficiary, "suggesting that HBUS 
has been processing cover payments for this client." 986 An email identified seven wire transfers 
over a one-year period, collectively involving more than $1.1 million, in which the 
documentation provided to HBUS made no reference to Sudan, preventing the transfers from 

987 

being stopped by HBUS' OFAC filter. The email noted that two of the wire transfers later 
blocked by other banks had resulted in letters from OFAC seeking an explanation for HBUS' 
allowing the transfers to take place, and suggested closing the client account to prevent more 
such incidents. On another occasion, HBUS identified five wire transfer payments between 
January and November 2007, totaling more than $94,000, that turned out to be intended for a 
Sudanese company, but had been processed as straight through payments at HBUS, because 
"there was no beneficiary address and no mention of 'Sudan'." 989 

In still other cases, wire transfers clearly referencing Sudan were stopped by HBUS' 
OFAC filter for further review, but then allowed by HBUS staff to proceed. An HBUS internal 
report on OFAC compliance noted, for example, two blocked wire transfers involving Sudan, 
one for over $44,000 and the other for over $29,000, blocked on November 5 and December 7, 
2007, respectively, by HBUS' OFAC filter, but subsequently "released due to human error." 990 

In August 2008, HBUS noted that it was then holding over $3.2 million in Sudan-related 
payments sent to the bank from other HSBC affiliates. 991 The bulk of the funds came from 
blocking a $2.5 million payment from HSBC Johannesburg destined for the Sudanese Petroleum 
Corporation, but three other Sudan-related payments from HSBC affiliates were also identified, a 
$300,000 payment sent by HSBC Hong Kong; a payment for more than $367,000 payment from 
HSBC Dubai, and a payment for more than $58,000 from British Arab Commercial Bank Ltd. 
The email listing these blocked funds noted that a court order was seeking transfer of the funds 



984 12/15/2006 email from HSBC Gimhani Talwatte to HSBC Krishna Patel, "PCM Operational error. Funds frozen 
in USA - payment on behalf of Commercial Bank of Ethiopia," OCC-PSI-006 10597, at 8. 
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986 7/8/2007 email from HBEU Joe Brownlee to HBEU Giovanni Fenocchi, forwarded by HBEU Peter May to 
HBUS Anne Liddy and HBUS Alan Ketley, "Arab Investment Company Reportable Event #3948 Notification 
Entity," OCC-PSI-00620281, at 2. 

987 Id. 
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989 Undated Global Transaction Banking report, "All Open Reportable Events," OCC-PSI-00823408, at 7. 

990 4/2/2008 HBUS memorandum, "Management Report for 1Q2008 for OFAC Compliance," OCC-PSI-00633713. 

991 8/8/2008 email from HBUS Anne Liddy to HSBC Susan Wright and others, "USS Cole Case," OCC-PSI- 
00304783 at 2-3. 
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to a federal court in the United States in connection with a lawsuit seeking compensation for the 
families of 17 U.S. sailors killed in a 2000 terrorist attack on the USS Cole in Yemen. 992 

In August 2010, in connection with an effort to exit correspondent relationships with 121 
international banks that HBUS determined it could no longer support, HBUS CEO Irene Dorner 
sent an email noting references to 16 banks in Sudan. Ms. Dorner wrote: 

"In Phase 2 there will be Trade names the exit for which may be more complicated but to 
give you a flavo[u]r of the problem we seem to have 16 correspondent banks in Sudan 
which cannot be right." 993 

(d) Transactions Involving Burma 

Another set of OFAC sensitive transactions involved Burma, also referred to as 
Myanmar, a country which, like Cuba and Sudan, was subject to a comprehensive sanctions 
program in the United States. 994 This program, first imposed in 1997, remains in effect today, 
although certain aspects of the program were suspended in May 20 12. 995 Internal bank 
documents indicate HBUS processed potentially prohibited transactions involving Burma from at 
least 2005 to 2010. 

One of the earliest references to transactions with Burma in the documents reviewed by 
the Subcommittee is a January 2005 email involving HBUS' Global Banknotes business, which 
involves the buying and selling of large quantities of physical U.S. dollars to non-U. S. banks. 996 
The email, written by HSBC Group Compliance head David Bagley, described a transaction in 
which HBUS purchased $2.9 million in U.S. dollars from a client, determined that the dollars 
had come from a certain party whose name was redacted by HBUS, and noted: "Myanmar is 
currently subject to OFAC regulations prohibiting any transactions by US persons relating to 
Myanmar counterparties." Mr. Bagley wrote: 

"There appears little doubt that the transaction is a breach of the relevant OFAC sanction 
on the part of HBUS, that it will need to be reported to OFAC and as a consequence there 
is a significant risk of financial penalty. It does not appear that there is a systemic issue, 
rather we are dealing with an individual incident, although given the potential seriousness 
of the breach external lawyers have been instructed to assist with the process of resolving 
matters with OFAC." 997 



992 Id. 

993 8/20/2010 email from HBUS Irene Dorner to HSBC Andrew Long and others, "Project Topaz US Urgent 
Requirements," HsBC OCC 8876105-106. 

994 See OFAC "Sanctions Programs and Country Information," Burma sanctions (last updated 4/17/2012), 
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In July 2005, HSBC Group issued its new GCL policy barring all HSBC affiliates from 
engaging in U.S. dollar transactions in violation of OFAC prohibitions. A few days later, on 
August 25, 2005, HSBC Group head of Global Institutional Banking, Mark Smith, circulated a 
managerial letter, referenced previously, identifying correspondent relationships that would be 
affected. The letter noted that the "Group has 2 account relationships with Myanmar entities," 
and stated that the "GCL applies in full," implying both relationships would have to be 
terminated. In September 2005, a senior HBEU payments official, Rod Moxley, who analyzed 
U.K. transactions stopped by the WOLF filter over a 10-day period noted that a number of the 
U.S. dollar transactions involved Burma. 999 



After the GCL's 2005 effective date, Burma-related transactions appear to have been 
reduced, but continued to occur. One example is a $15,000 payment that originated in Burma on 
January 18, 2008, was processed as a straight-through payment at HBUS, and blocked by the 
OFAC filter at another bank involved with the transaction. 1 1 An HBUS email explained that 
the payment had not been blocked at HBUS, because its OFAC filter didn't recognize "Yangon," 
the former capital of Burma, also called "Rangoon," as a Burma-related term. According to the 
email, it was the second payment involving "Yangon" that was missed by the HBUS filter. 
HBUS Compliance head Carolyn Wind requested that the filter be fixed immediately: "We are 
running too much risk that these misses will cause OFAC to start questioning the effectiveness of 
our controls." 1001 



Four months later, HBUS blocked an April 2008 wire transfer for $12,060 headed for the 
account of an SDN-listed entity at Myanmar Foreign Trade Bank. An internal bank document 
noted that the payment had been blocked by HBUS due to "references to Yangon and Myanmar, 
rather than blocking it due to the sanctioned entity[']s involvement." The document noted that 
the bank code "for the sanctioned entity was not included in the payments filter, as per agreed 
upon procedure with the UK WOLF team," and a systems fix was implemented in October 



In May 2010, two additional Burma-related U.S. dollar transactions were processed by 
HBUS, due to limitations in the WOLF filter. In one instance, a payment was not blocked, 
because "the filter did not list 'Burmese' as an a.k.a. [also known as] for Burma." In the other 
instance, the "filter did not identify 'Mynmar' as a possible reference to Myanmar." 1003 



8/25/2005 managerial letter from HSBC Mark Smith to HBUS Aimee Sentmat, HBME Alan Kerr, and others, 
"GCL050047 - Compliance with OFAC sanctions," HSBC OCC 3407565569; 8/25/2005 email from HBUS Alan 
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569. 

999 See 9/23/2005 email from HBEU Rod Moxley to HSBC John Allison and HSBC John Root, "OFAC sanctions," 
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1001 Id. at 0616168. 
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(e) Transactions Involving North Korea 

Still another set of OFAC sensitive transactions involved North Korea which, unlike 
Burma, Cuba and Sudan, is not subject to a comprehensive U.S. sanctions program, but has 
particular persons and entities included in the OFAC SDN list. 1004 

In August 2005, a month after HSBC Group issued the GCL policy barring HSBC 
affiliates from engaging in U.S. dollar transactions in violation of OFAC prohibitions, HSBC 
Group head of Global Institutional Banking, Mark Smith, circulated a managerial letter 
identifying correspondent relationship that would be affected. 1005 The letter stated: "The Group 
has 3 account relationships with North Korean entities. These are all inhibited. We have been 
seeking to close the accounts, and will continue to do so, for some time but have not been able to 
elicit a response from the banks concerned." 1006 

Nearly two years later, in 2007, an internal HSBC document entitled, "Information 
Requested in Connection With: (North Korea, Cuba, and Myanmar)," revealed that, as of May 
2007, HSBC affiliates in Mexico and Latin America were providing U.S. dollar accounts to 
North Korean clients. 1007 The document indicated that HSBC Mexico (HBMX) had nine North 
Korean customers with nine U.S. dollar accounts holding assets exceeding $46,000, and seven 
North Korean customers with both U.S. dollar and Mexican peso accounts whose assets totaled 
more than $2.3 million. 1008 The document indicated that arrangements had been made to "cancel 
all business relationships with" North Korea, in relation to U.S. dollar accounts or commercial 
relationships for the entire region. 

In addition, HBUS did not close a U.S. dollar account with the Foreign Trade Bank of the 
Democratic People's Republic of Korea until April 28, 2010, although a review of the account 
indicated that no U.S. dollar activity had taken place in it since 2007. 1009 

(f) Other Prohibited Transactions 

In addition to transactions involving jurisdictions subject to U.S. sanctions programs, 
some transactions sent to HBUS involved prohibited individuals or entities named on the OFAC 
SDN list. While many of these transactions were not sent by HSBC affiliates, some were. 
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HBUS did not allow such transactions to proceed, showing the effectiveness of the OFAC filter 
when all appropriate transactions are run through it. 

On November 9, 2006, for example, "at the direction of OFAC," HBUS blocked for 
further review a $32,000 payment that had been originated by HBME, because the underlying 
payment details indicated the funds were to be credited to Al Aqsa Islamic Bank. 1010 This bank 
had been designated as a "specially designated global terrorist" by OFAC in December 2001, 
because it was a "direct arm of Hamas, established and used to do Hamas business." 1011 On 
November 20, 2006, HBME asked HBUS to cancel the payment, because "it was sent in error." 
On December 7, 2006, however, OFAC instructed HBUS to continue to block the funds. HBUS 
AML Compliance head Teresa Pesce wrote: "How is it that these payments continue to be 
processed by our affiliates in light of the GCLs?" 1012 

A report prepared by Deloitte at HBUS' request, examining the period 2001 to 2007, also 
disclosed that one U.S. dollar correspondent account located in the United Kingdom had been 
opened for a bank located in Syria, while two U.S. dollar correspondent accounts in the United 
Kingdom had been established for the "Taliban." 1013 When asked about the correspondent 
account for a bank established for the Taliban, HSBC legal counsel told the Subcommittee that 
HBEU had maintained an account for Afghan National Credit and Finance Limited, the London 
subsidiary of an Afghan bank that, from October 22, 1999 to February 2, 2002, was designated 
under OFAC's Taliban sanctions. 1014 An HBUS representative told the Subcommittee that 
HBUS was unable to go back far enough in its records to uncover whether or not the Afghan 
account at HBEU sent transactions through HBUS during that time. 1015 The fact that HBEU had 
this account after the 9-11 terrorist attack on the United States again demonstrates how HSBC 
affiliates took on high risk accounts that exposed the U.S. financial system to money laundering 
and terrorist financing risks. These U.S. dollar accounts may also have contravened the 2005 
GCL and OFAC regulations by enabling banks in Syria and Afghanistan when it was controlled 
by the Taliban to engage in U.S. dollar transactions through HBUS. 

Another account involving an individual on the OFAC list was housed at HSBC Cayman 
Islands. On February 21, 2008, a Syrian businessman by the name of Rami Makhlouf was 



,u,u 12/14/2006 email from HBUS Elizabeth Protomastro to HBUS John Allison and others, "OFAC - Wire 
payments blocked from HSBC offshore entities - USD 32,000 (re SDGT) and USD 2,538,939.33 (re Sudan)," 
HSBC OCC 3407608-609. 

1011 1/9/2007 email from HBUS Elizabeth Protomastro to HSBC John Allison, HBUS Teresa Pesce, Anne Liddy, 
and others, "OFAC - Wire payments blocked from HSBC offshore entities - USD 32,000 (re SDGT) and USD 
2,538,939.33 (re Sudan)," OCC-PSI-00610498, at 2. 

1012 See 12/15/2006 email from HBUS Teresa Pesce to HBUS Elizabeth Protomastro and others, "OFAC - Wire 
payments blocked from HSBC offshore entities - USD 32,000 (re SDGT) and USD 2,538,939.33 (re Sudan)," 
HSBC OCC 3407608. 

1013 10/18-10/19/201 1 "Transaction Review Progress and Results Reporting," prepared by Deloitte LLP, HSBC-PSI- 
PROD-0096628-672, at 649. 

1014 Subcommittee briefing by HSBC legal counsel (7/9/2012). See also "UK Observer Reports Taliban Banks Still 
Operating in London," London The Observer , Sunday edition of The Guardian (10/1/2007); "Schwerer Schlag": Ein 
kleines Geldhaus in London diente offenbar als Hausbank der Taliban," [Serious Blow: A small Financial 
Institution in London apparently served as Taliban's main bank"], Der Spiegel , Christoph Von Pauly (10/8/2001). 
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placed on the SDN list by OFAC. One week later, HSBC Cayman Compliance personnel 
contacted HBUS to report that HSBC Cayman Islands currently held a trust relationship with Mr. 
Makhlouf and to inquire as to "what actions if any HSBC Group has taken in relation to the 
above mentioned individual." 1017 An HBUS Compliance officer asked the Cayman Compliance 
officer for more information about the Makhlouf accounts, and the head of HSBC Cayman 
Compliance responded: "The Trust is administered by HSBC Geneva. We raised concerns with 
this client in August 2007 however we were assured by David Ford that the relationship had been 
reviewed at a Group level and a decision had been taken to continue with the relationship." 1018 
Ultimately, HBUS determined that it did not have any connection to Mr. Makhlouf and did not 
need to report any information to OFAC. 

(3) HBUS' OFAC Compliance Program 

Internal bank documentation related to HBUS' OFAC compliance efforts regarding 
OFAC sensitive transactions portrays a variety of specific problems over the period reviewed by 
the Subcommittee. One problem was that some HSBC affiliates continued to offer U.S. dollar 
accounts to prohibited persons despite HSBC Group policy and OFAC regulations, and 
continued to send transactions involving those accounts through their U.S. dollar accounts at 
HBUS. A second problem was the ongoing practice by some HSBC affiliates and others to use 
methods of processing transactions which did not disclose the participation of a prohibited 
person or country when sending a transaction through an account at HBUS. Even some within 
HSBC worried that such methods would look deceptive to its U.S. regulators. In other cases, 
prohibited transactions were not detected by HSBC's WOLF filter or HBUS' OFAC filter due to 
programming deficiencies that did not identify certain terms or names as suspicious. In still 
other cases, transactions that had been properly blocked by the WOLF or OFAC filter were 
released by HSBC or HBUS employees in error, due to rushed procedures, inadequate training, 
or outright mistakes. Beginning in 2008, spurred in part by an upcoming OCC examination of its 
OFAC compliance program, HBUS took a closer look at its program as a whole. 

On September 28, 2008, HBUS received a cautionary letter from OFAC regarding "12 
payments processed from September 4, 2003 through February 1, 2008 which represent possible 
violations against U.S. economic sanctions." 1019 That same month, HBUS learned that the OCC 
planned to review its OFAC operations as part of a November 2008 examination of HBUS' 
Payments and Cash Management (PCM) division. 1020 In response, HBUS undertook a detailed 
analysis of not only the 12 transactions highlighted by OFAC, but also other prohibited 
transactions that had been processed through the bank since issuance of the 2005 GCL policy. 



lulb See 2/21/2008 U.S. Department of Treasury Press Release No. HP-834, "Rami Makhluf Designated For 
Benefiting from Syrian Corruption," http://www.treasury.gov/press-center/press-releases/Pages/hp834.aspx ("The 
U.S. Department of the Treasury today designated Rami Makhluf, a powerful Syrian businessman and regime 
insider whom improperly benefits from and aids the public corruption of Syrian regime officials."). 

1017 2/28/2008 email exchange among HBUS Andy Im and HSBC Cayman Islands Patricia Dacosta and Michelle 
Williams, HSBC OCC 8870981. 

1018 Id. 

1019 9/29/2009 OFAC Cautionary Letter, HSBC-PSI-PROD-0096180-181. 

1020 See 10/3/2008 email from HBUS Lesley Midzain to HBUS Janet Burak, HSBC David Bagley, and HBUS Anne 
Liddy, "OFAC 'Cautionary Letter' received today," HSBC OCC 3406951-952. 
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On October 3, 2008, a member of HBUS' OFAC Compliance team Elizabeth 
Protomastro forwarded the OFAC letter to HBUS Compliance head Leslie Midzain. 1021 Ms. 
Midzain, in turn, forwarded it to HSBC Group Compliance head David Bagley and HNAH's 
regional Compliance head Janet Burak. 1022 Ms. Midzain wrote that she was giving them an 
"immediate heads up" because of the "additional [OFAC] failures since February 2008," the 
upcoming OCC examination in November, and the "continued sensitivity" surrounding OFAC 
compliance. She stated that the matter would "receive high priority." 1023 

On November 6, 2008, Ms. Midzain provided Mr. Bagley and Ms. Burak with detailed 
charts on the 12 prohibited transactions as well as a larger number of prohibited transactions that 
had been mistakenly processed by the bank. 1024 To provide context to the figures, she noted that 
HBUS processed approximately 600,000 wire transfers per week, of which about 5%, or 30,000 
transactions, generated "possible [OFAC] matches which require review prior to releasing." 1025 
She wrote that, over a five-year period from 2003 to 2008, HBUS had "rejected and reported 
1,212 transactions valued at $100 million" to OFAC. 1026 She explained that, in addition, HBUS 
had self-reported 79 missed transactions to OFAC that should have been blocked, but weren't. 
Of those, she wrote that HBUS had identified "approximately] 57" that were issued subsequent 
to the 2005 GCL that were "contrary to sanction requirements and for which HSBC was the 

1027 

originating bank." She noted that some of the issues had arisen after HBUS replaced its 
OFAC filter in July 2007, and may have been due to gaps in the filter that were closed "as the 
system [was] refined." 1028 

Ms. Midzain reported that the 79 missed transactions primarily involved Iran and 
Sudan. 1029 Other transactions involved Cuba, Iraq, Syria, Zimbabwe, and persons on the SDN 
list. Ms. Midzain explained that of the 57 missed transactions that occurred since issuance of the 
July 2005 GCL policy barring HSBC affiliates from processing U.S. dollar transactions for 
OFAC sensitive persons, 21 or about one-third had nevertheless originated with an HSBC 
affiliate. 1030 Of those 21, her analysis noted that about five did not contain a reference to a 
prohibited person. Her analysis suggests that an HSBC affiliate may have been using a cover 
payment which would mask the nature of the transaction from HBUS. 1031 Ms. Midzain wrote: 
"Regarding Group members, since Group policy was issued JUL05, we have nonetheless 
received a fairly notable number of payments that suggest HSBC banks have not been 
consistently applying the policy." 10 2 She also noted that the analysis had not examined the 



Emails between HBUS Elizabeth Protomastro, HBUS Lesley Midzain, and others on October 3, 2008, "OFAC 
'Cautionary Letter' received today," HSBC OCC 3406952-953. 

1022 10/3/2008 email from HBUS Lesley Midzain to HBUS Janet Burak, HSBC David Bagley, and HBUS Anne 
Liddy, "OFAC 'Cautionary Letter' received today," HSBC OCC 3406951-952. 

1023 Id. 

1024 1 1/6/2008 email exchanges among HBUS Leslie Midzain, HSBC David Bagley, HBUS Janet Burak, and others, 
"OFAC analysis," HSBC OCC 0616010-026. 
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at 0616016. 
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at 0616014. 
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population of payments that HBUS stopped over the years to see how many of them also came 
from HSBC affiliates. Her figures also did not reflect the larger universe of potentially 
prohibited transactions that were processed by the bank without either HBUS or OFAC detecting 
them. 

David Bagley, HSBC Group Compliance head, thanked Ms. Midzain for her analysis. 
He also wrote: 

"As you know, we have just completed and are currently collating the results of a 
Groupwide Compliance review of compliance with our USD/OFAC policy. 

Whilst some of these apparent breaches of Group policy may be rather historic 
nevertheless I am determined that we should enforce our policy on a consistent and 
Groupwide basis. 

Given this, what I would like to do is at Group level track back relevant and apparently 
offending payments and establish root causes so as to satisfy ourselves that there can be 
no, or at the very least, far less repetition. It is of course unrealistic to expect that no 
payments will pass through to HBUS, and at least our move to transparency in form of 
serial payments should allow these to be caught nevertheless I would prefer that 
payments were rejected at point of entry." 1033 

The OCC examination took place near the end of 2008. It tested the bank's OFAC 
systems to determine if OFAC screening was being properly applied to new accounts, wire 
transfers, and other transactions. 1034 An internal OCC memorandum stated that, as of June 30, 
2008, "HBUS reported 370 items on the OFAC blocked report, valuing approximately $20 
million." It reported that, from September 2003 to September 2008, HUBS had "rejected and 
reported to OFAC over 1,200 transactions valuing $100 million." 1035 The memorandum also 
stated that HBUS was then processing about 600,000 wire transfers per week, of which 6%, or 
about 30,000, were manually reviewed each week by four-person OFAC Compliance teams in 
Delaware and New York. The OCC wrote that, of the wire transfers that underwent manual 
review, 20 to 30 per day were "escalated" and required a "disposition decision from compliance 
management." 1036 The OCC memorandum reported: 

"Although, according to management, within the past five years (9/03-9/08) there ha[ve] 
been only 80 missed payments, the bank's Compliance teams are under rigorous pressure 
to process alerts and determin[e] a disposition in a timely maner. . . . [T]his strain can and 
will inhibit their mental capacity leaving gaps for errors even though permanent current 
staff members are well trained and qualified to complete the OFAC responsibilities." 



1033 1 1/1 1/2008 email from HSBC David Bagley to HBUS Leslie Midzain and HSBC Susan Wright, "OFAC," 
HSBC OCC 0616010-011. 

1034 7/28/2008 OCC memorandum, "OFAC Examination - Payment and Cash Management (PCM)," OCC-PSI- 
01274962. [Sealed Exhibit.] 

1035 Id. at 3. 

1036 Id. at 4-5. 
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On January 20, 2009, the OCC sent HBUS a Supervisory Letter with generally positive 
examination findings regarding its OFAC compliance efforts. The Supervisory Letter stated: 

"• OFAC Compliance is High and Increasing. The quality of risk management systems 
is satisfactory. 

• Compliance with legal and regulatory requirements is satisfactory and no violations of 
law or regulation were cited at this examination. 

• One recommendation is made related to staffing." 

The Supervisory Letter stated that the OFAC risk was high and increasing due to "almost 
a zero tolerance for error" under OFAC regulations and increasing growth in HBUS' PCM and 
retail banking businesses. The staffing recommendation, which did not require corrective action, 
stated: "Management should consider a review of current staffing requirements to ensure that 
there is an adequate number of permanent qualified staff to prolong the timely operations 
associated with OFAC related matters and to ensure adherence with regulatory requirements . . . 
as your business grows." 1039 Despite the OCC's generally positive examination, internal bank 
documents indicate that HBUS itself had a much more negative view of its OFAC compliance 
program. In June 2009, HBUS initiated an "OFAC Program Review Project." 1040 Four months 
later, in October 2009, Debra Bonosconi, the HBUS Director for Specialized Compliance 
overseeing the Embassy Banking business, sent an email to Anthony Gibbs, the COO of HSBC 
North America Legal and Compliance, commenting on a number of compliance issues, including 
OFAC compliance. 1041 Ms. Bonosconi, who had begun working at HBUS in March 2008, wrote 
that she had only recently become aware of the negative findings of the OFAC Program Review 
Project. She explained: 

"This project has been underway since June and the findings that have surfaced are no 
different than those already identified previously. So, we have a project that has taken far 
longer than it should have and findings that do not vary significantly from previous 
reviews. 



The bottom line is, our OFAC process is in disarray and in great risk of being 
noncompliant. We have multiple systems, inconsistent practices, limited communication 
between the various functions, and no oversight function." 1042 

This candid description of the bank's OFAC compliance program, as having "inconsistent 
practices," "limited communication," and "no oversight function," stands in marked contrast to 
the OCC findings less than a year earlier. 



See OCC Supervisory Letter HSBC-2008-41, "Office of Foreign Asset Control Examination," OCC-PSI- 
00000434-436. [Sealed Exhibit.] 

1038 Id. at 1. 

1039 Id. at 3. 

1040 See 10/23/2009 email from HBUS Debra Bonosconi to HBUS Anthony Gibbs, "comments," HSBC OCC 
3405534-537. 

1041 Id. 

1042 Id. at 3405537. 
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Another sign of the stresses in the OFAC compliance program surfaced in December 
2009, when the four-person OFAC Compliance team in New York faced an accumulated 
backlog of greater than 700 OFAC alerts that had yet to be reviewed. 1043 The OFAC 
Compliance team requested five or six people from the Payments and Cash Management (PCM) 
department for ten days to help clear the backlog. 1044 PCM responded that it had no resources to 
loan, and suggested asking Compliance personnel in Delaware for help. The OFAC Compliance 
team in New York responded the Delaware Compliance staff was already "fully deployed" 
dealing with general alerts from the CAMP monitoring system: 

"We have considered all options at this point[;] the Compliance team in DE is already 
fully deployed dealing with wire camp alerts and bank examiner requests for the current 
exam. There is no bandwidth there at all[;] they are behind on the current alert clearing 
process which we are also dealing with." 1045 

In late 2011, the OCC conducted a second examination of HBUS' OFAC compliance 
program and, on January 25, 2012, issued a Supervisory Letter with a more negative 
assessment. 1046 The Supervisory Letter stated that the OCC was "concerned about the number 
and severity of the deficiencies in the enterprise- wide OFAC compliance program" at HBUS and 
at two other HSBC affiliates in the United States, HSBC Nevada, N.A. and HSBC Trust 
Company (Delaware), N.A. It stated that the OCC had reviewed reports prepared by HBUS' 
own auditors and by an outside consultant that "identified significant deficiencies in the 
program." It noted that bank management had taken "significant steps" to address deficiencies, 
but concluded the "three banks lack a robust OFAC risk assessment that ensures the OFAC risks 
have been adequately identified so they can be managed appropriately." The Supervisory Letter 
contained two Matters Requiring Attention (MRAs) by the bank: (1) development of a 
"comprehensive OFAC risk assessment;" and (2) an independent review of certain real estate 
loans through a California branch between 2009 and 201 1, involving Iran, that raised OFAC 

1 047 

concerns. The Supervisory Letter also included a three-page attachment identifying OFAC 
violations cited in seven OFAC cautionary letters since June 2009. The OCC required HBUS to 
modify the AML action plan it was developing in response to a September 2010 Supervisory 
Letter necessitating broad improvements in its AML program to include the MRAs on its OFAC 

r 1048 

compliance program. 

Since the OCC examination, OFAC has issued one more cautionary letter to HBUS. 
Altogether, six of the pending OFAC letters warned that the violations might result in a civil 
monetary penalty, but no penalty has been imposed as of June 2012. 



1043 12/1 1/2009 email exchange among HBUS Camillus Hughes and HBUS Michael Gallagher, Charles DelBusto, 
Sandra Peterson, Thomas Halpin, Chris Davies, and Lesley Midzain, "OFAC Payments," HSBC OCC 7688668-670, 
at 670. 

1044 M 

1045 Id. at HSBC OCC 7688668. 

1046 See 1/25/2012 OCC Supervisory Letter HSBC-2012-03, "OFAC Compliance Program," OCC-PSI-0 1768561- 
566. [Sealed Exhibit.] 

1047 Id. at 2. 

1048 Id. at 3. 
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(4) Server Issues 

One additional issue involving OFAC-sensitive transactions involves payment messages 
associated with non-U. S. dollar transactions that were sent through servers physically located in 
the United States, but which were not processed by HBUS and were not screened by an OFAC 
filter. The key issue is whether the electronic presence of those payment messages in the United 
States, utilizing U.S. facilities on their way elsewhere, required application of the OFAC 
filter. 1049 Despite concern expressed by HBUS, the bank decided not to turn on the HBUS 
OFAC filter to screen these payment messages. 

WHIRL Server. In the documents reviewed by the Subcommittee, server issues appear 
to have first arisen in 2003, when the HSBC Group Executive Committee discussed establishing 
a new server in the United Kingdom to process credit card transactions, instead of continuing to 
route those transactions through a server in the United States, for the express purpose of 
"avoiding] contravening the OFAC restrictions." 1 1 In January 2004, the HSBC Group Board 
of Directors approved installing a separate, so-called "WHIRL system" in the United Kingdom at 
an estimated cost of $20 million. 1051 When asked about the WHIRL server, Mr. Bagley told the 
Subcommittee that the bank had moved the payment processing outside of the United States to 
protect HBUS, that he viewed it as a broad reading of OFAC rules at the time, and that he saw it 
as a conservative decision. 1052 

By 2005, the WHIRL server was active. In November 2005, Mr. Bagley asked Mr. Root 
to follow up on certain HBMX compliance issues identified by Mexican regulators, including the 
processing of credit card transactions. Mr. Bagley wrote that even through the credit card 
transactions "are, or will be processed on the UK Whirl server the routing of the relevant 
messages may pass through the U.S. first." 1053 He also wrote: "If this is the case then we may 
still have an issue dependent on how much intervention is theoretically possible on the part of the 
US leg." The following day, the head of HBMX Compliance Ramon Garcia informed Mr. Root 
and Mr. Bagley that WHIRL transaction messages were still being routed through a U.S. server 
"for a fraction of a second for later transfer to the UK," which could be long enough for a "log 
file" to exist in the United States identifying the transactions. 

HSBC Affiliates in the Americas. Six months later, in April 2006, Mr. Bagley proposed 
that "countries in the Americas outside USA disconnect their payment routing link to the USA 
TP Gateway and reconnect to the UK TP." He indicated doing so would provide two main 
benefits: "firstly the ability to make payments in currencies other than USD to 
countries/names/entities sanctioned by USA OFAC (as permitted by GCL 050047), and secondly 



When asked, OFAC declined to provide a definitive answer to the Subcommittee in the abstract, indicating that 
its analysis would have to examine specific facts. Subcommittee briefing by OFAC (5/8/2012). 

1050 See 1/30/2004 Board of Directors minutes for HSBC Holdings pic, HSBC-PSI-PROD-0198571-572. The 
HSBC Group Executive Committee consisted of senior executives in HSBC. 

1051 See 1/30/2004 Board of Directors minutes for HSBC Holdings pic, HSBC-PSI-PROD-0198571-572. 

1052 Subcommittee interview of David Bagley (5/10/2012). 

1053 See 1 1/15-22/2005 email exchanges among HSBC David Bagley, HSBC John Root, and HBMX Ramon Garcia, 
"HBMX - Compliance Issues," HSBC OCC 8873261-266. 
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to take data records outside USA." His email raised the issue of whether electronic payment 
messages routed through a U.S. server could be subject to HBUS' OFAC filter and the obligation 
to block all potentially prohibited transactions. 

In November 2006, at a meeting of the HBUS Compliance Risk Management Committee, 
then HBUS Compliance head Teresa Pesce advised: "Plans are underway to implement OFAC 
screening for messages sent by the Americas through the global messaging gateway in the US in 
2007." 1055 Her decision to inform the committee of that development indicates that payment 
messages already being routed through the U.S. server were not being scanned against the OFAC 
filter. If the OFAC filter was not being used, all of the payment messages being sent through the 
United States by HSBC affiliates in Latin America were not being screened for terrorists, drug 
traffickers, or other wrongdoers. 

Four months later, in March 2007, Mr. Bagley contacted Alexander Flockhart, then 
HSBC Latin America CEO, about Latin America payment messages being routed through the 
U.S. server, in light of the increased focus on OFAC compliance "on the part of both OFAC" and 
"our banking regulators." 1056 Mr. Bagley noted that HBUS was required to screen all 
transactions for compliance with OFAC requirements, including all non-U. S. dollar transactions, 
which "would clearly be disadvantageous from Latin America's perspective," since the logistics 
of screening all those transactions "would be commercially and operationally challenging" for 
Latin American affiliates. Mr. Bagley informed Mr. Flockhart that they were developing a stand- 
alone WHIRL server in the United Kingdom that Latin America could use and which would 
avoid OFAC screening. He commented that if Mr. Flockhart "want[ed] to carry out as many 
transactions permitted by Group policy as possible," he should relocate Latin America's payment 
processing "to a different Group Messaging Gateway" than the one in the United States. 

Mr. Bagley also noted that HSBC Group had already "informally explored" the possible 
relocation of Latin America payment processing to the U.K. server, but realized that gateway 
was already experiencing capacity issues. Mr. Bagley commented further that the existing 
situation in which "the filtering" was not turned on was making HSBC's U.S. colleagues 
"extremely uncomfortable": 

"Whilst we have lived with the current position for some time, it is fair to say that now 
that our US colleagues are on notice they feel extremely uncomfortable in allowing the 
position to continue indefinitely. In essence, we will either have to have a pass and 
timeline for a relocation of the payment messages or will need to turn the filtering 
on." 1057 

Mr. Bagley does not make it clear how his U.S. colleagues were put "on notice," and when 
asked, he told the Subcommittee that he did not recall who he talked with at HBUS about the 



1054 4/10/2006 email from HSBC David Bagley to HBBR Luis Eduardo, HBMX David Leighton, and others, "TP 
Gateways," HSBC OCC 7687437-438. 

1055 1 1/13/2006 Compliance Risk Management Committee minutes for HBUS, HSBC OCC 3407449-451. 

1056 3/13/2007 email from HSBC David Bagley to HBMX Sandy Flockhart, "Group Messaging," HSBC OCC 
8874354-355. 

1057 Id. at 8874355. 
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issue, but he did indicate clearly that the OFAC filter was not turned on for the U.S. server being 
used to forward payment messaging traffic from HSBC affiliates in Latin America. 1058 Five 
months earlier, HBUS Compliance head Teresa Pesce told the HBUS Compliance Risk 
Management Committee that payment messages sent by the Americas through the U.S. gateway 
would be scanned for OFAC beginning in 2007; Mr. Bagley's email indicates that, as of March 
2007, the OFAC filter had still not been turned on, and his U.S. colleagues were "extremely 
uncomfortable in allowing the position to continue indefinitely." 

The following day Mr. Flockhart asked for a contact to discuss re-routing Latin American 
payment messaging traffic through the U.K. server. A few days after that, Mr. Bagley provided 
the contact information and also notified Mr. Flockhart that HSBC Brazil was considering 
"giving up certain payments activity given the challenges of passing that activity through the 
us „i059 Mr Bagley wrote that the HSBC Group had asked HSBC Brazil to postpone that 
decision until it was determined whether payment messaging could be "migrated elsewhere." 
Mr. Bagley also wrote: "There may also need to be a conversation at some stage with Paul 
Lawrence [then HBUS CEO] if it is necessary to persuade HBUS to continue with payment 
messaging pending any migration." 1060 In this email, the head of HSBC Group Compliance 
seems to be advocating sending non-U. S. dollar payments through the U.S. gateway without 
monitoring the transactions for OFAC compliance, pending migration of the Latin American 
traffic to another server. When Paul Thurston, former head of HBMX, was asked about Mr. 
Bagley's comments, he expressed surprise that the HSBC Group Compliance head took that 
position. 1061 In June 2007, Mr. Flockhart approved switching Latin America's non-U. S. based 
SWIFT traffic to the U.K. gateway citing it as the most cost effective solution. 1062 

Around the same time, HSBC Brazil (HBBR) also sought to move its transactions from 
the U.S. to the U.K. server to avoid the OFAC filter. In December 2006, HBBR contacted 
Malcolm Eastwood at HBEU, asking for assistance in obtaining a second SWIFT address to be 
used for HBBR payments going to Iran, Cuba, and other sanctioned countries. HBBR explained 
that these transactions — about 50 per year — were compliant with Group policy, but ran the risk 
of being blocked by the U.S. server they currently utilized, which was why it wanted to switch 
the transactions to the U.K. server and execute them in Euros. HBBR wrote: "To enable it, we 
have been informed that we have to create a second SWIFT address (BIC) to be used exclusively 
for this purpose, which should also not be published by SWIFT in their books." 1063 



1U3!! Subcommittee interview of David Bagley (5/10/2012). 

1059 3/22/2007 email from HSBC David Bagley to HBMX Sandy Flockhart, "Group Messaging," HSBC OCC 

8875066-067. 

1060 w 

1061 Subcommittee interview of Paul Thurston (5/1/2012). Mr. Bagley said that the reason he suggested to Mr. 
Flockhart that the messages be moved to the U.K. gateway was because he had received a legal opinion, which he 
considered "extreme," that non-U. S. dollar messages going through a U.S. messaging center could be impacted by 
OFAC. He was, thus, acting in a conservative manner to avoid violating OFAC requirements. Subcommittee 
interview of David Bagley (5/10/2012). 

1062 6/1/2007 email from HBMX Sandy Flockhart to HBMX Neelesh Heredia and others, "Group Messaging 
Gateway for LAM - Clear Choice Report," HSBC OCC 8874349-350. 

10 3 12/18/2006 email from HBBR Morgana Casagrande to HBEU Malcolm Eastwood and others, "Transactions 
with Iran/Cuba, etc.," HSBC OCC 8876927-928. 
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In response, Mr. Eastwood reached out to HSBC Group Compliance and HBEU 
operational staff to discuss practical issues with Brazil's routing "US sanctioned items" via the 
U.K. server. He wrote: "I have concerns that we might be breaching at least the spirit of the US 
Serial Routing GCL if not the letter of it." 1064 HSBC Group Money Laundering Control Officer 
John Allison responded that, by using the U.S. server, Brazil was subject to an "all currency 
prohibition for all OFAC entries," but HSBC Group policy allowed Brazil to make payments in 
non-U. S. dollar currencies to entities on the OFAC list, so long as they were not linked to 
terrorism or Weapons of Mass Destruction. At the same time, he expressed concern about the 
perception of HSBC s obtaining an additional SWIFT address dedicated to payments intended 
for OFAC sanctioned countries. 

Mr. Eastwood forwarded this email correspondence to HBEU colleagues with the 
comment: "Just fyi. This all makes me very nervous!" HBEU' s Rod Moxley responded that 
trying to identify and process transactions "which have so many conditions attached to them" 
was a predicament for them. He wrote: "Slightly irritating too that GHQ CMP [Group 
Headquarters Compliance] seem to have bent over backwards to accommodate a system which 
looks very dodgy to me. How about no you can't do this?" 1065 On January 2, 2007, Mr. Moxley 
sarcastically described setting up a second SWIFT address an "interesting concept," forwarded 
the idea to a colleague, and wrote: "let's set up a completely different Swift address to help 
avoid any problems with Cuba and Iran. Wish I'd thought of it." 1066 

On January 26, 2007, Mr. Eastwood responded to Brazil's request. 1067 He indicated in a 
memorandum that, after conferring with HSBC Group Compliance and operational personnel, 
they were not favorable to segregating certain transactions through separate SWIFT addresses, 
even though the transactions were permissible under Group policy, due to the possible perception 
of "taking action to avoid certain transactions being examined by the US authorities." Instead, 
Mr. Eastwood noted that HBBR could re-route all of its SWIFT traffic via the U.K. server, 
listing several logistical issues that would have to be resolved if Brazil wanted to move forward. 

These documents raise the question of whether non-U. S. dollar payment messages 
referencing transactions routed through a U.S. server by HSBC affiliates were required to be 
screened by an OFAC filter, or whether they could move across U.S. boundaries and use U.S. 
facilities without triggering any OFAC prohibitions. On the one hand, HSBC Group Compliance 
urged Latin America to switch their messaging traffic from a U.S. to a U.K. server to avoid the 
delays that come with OFAC screening, while on the other hand indicating that for at least a five- 
month period from November 2006 to March 2007, the OFAC filter had not been turned on to 
screen the Latin American payment messages going through the U.S. server even though HBUS 
apparently had expressed concerns about not screening the messages for prohibited activity. 



12/21/2006 email from HBEU Malcolm Eastwood to Bill Rice and others, "Fw: Transactions with Iran/Cuba, 
etc," HSBC OCC 8876927. 

1065 See 12/28/2006 - 1/4/2007 email exchanges among HBEU Malcolm Eastwood, HSBC John Allison, HBEU 
Rod Moxley, and others, "Transactions with Iran/Cuba, etc.," HSBC OCC 8876925-927. 

1066 1/2/2007 email from HBEU Rod Moxley to HBEU Andy Newman, "Transactions with Iran/Cuba, etc," HSBC 
OCC 8876921. 

1067 1/26/2007 memorandum from HBEU Malcolm Eastwood to HBBR Lucas Fragoso and others, "Trade 
Transaction with Iran/Cuba etc.," HSBC OCC 8876930-931. 
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HSBC Group knowingly put its U.S. affiliate at regulatory and reputational risk by moving 
payment messages through a U.S. server without scanning them against the OFAC filter. 

Turning Off OFAC Verification. A very different server issue arose in July 2007, 
when HBUS introduced a new product called Fircosoft to help monitor OFAC sensitive 
transactions. The product caused a huge increase in the number of OFAC alerts, creating a 
backlog that began to overwhelm HBUS OFAC compliance personnel. According to a fourth 
quarter 2007 Compliance Report by HBUS, the introduction of the new product caused "serious 
performance issues" that would "not support HBUS volumes." 1068 On July 17, 2007, "a risk 
based decision was made to eliminate the verification step of all OFAC filter alerts on a 
temporary basis to accelerate the process of clearing the OFAC queue." 1069 The more limited 
review process for OFAC sensitive transactions remained in effect for about three weeks, from 
July 17 to August 6. On August 1, 2007, HBUS Chief Operating Officer David Dew wrote: "I 
think that we simply must now agree on a definitive timetable for reintroduction of full OFAC 
controls." 1070 When asked about this matter, Mr. Dew told the Subcommittee that he thought the 
limitation on the "verification step" in the OFAC filter was only stopped for about a day. 1071 
Anne Liddy told Subcommittee that she recalled that the verification step was turned off for 
about a month, but didn't view it as a risk to the bank. 1072 

In 2009, the same verification step in the OFAC filter was again turned off by HBUS for 
a few weeks. In November 2009, due to an industry-wide switch to SWIFT202 cover payments, 
OFAC alerts increased dramatically at HBUS. HBUS was so concerned about the large number 
of false OFAC hits being generated that it stopped the verification step, as was done in 2007. 
Turning off the verification step concerned one HBUS employee enough that the employee 
quietly reported the action to the Federal Reserve. The Federal Reserve examiner who spoke 
with the employee wrote in an email to colleagues that the HBUS employee reported: 

"On Monday Lesley Midzain, former head of BSA/AML turned off the second level filter 
on Chips activity without consulting anyone and with no supporting documentation. The 
rational given for turning the second level filter off was to reduce the daily backlog in 
lieu of additional resources. The individual who spoke to me knew this was not 
appropriate action and decided to call the [regulator]." 1073 

HSBC's legal counsel told the Subcommittee that the verification step was turned off for 13 
days, from November 25, 2009 and December 7, 2009. 1074 The issue raised by both incidents in 
2007 and 2009, is whether HBUS' decision to turn off part of the OFAC filtering system reduced 
its effectiveness in screening for prohibited transactions and increased U.S. vulnerabilities to 
money laundering and terrorist financing. 



1068 4Q07 Compliance R e p 0rt from HBUS Carolyn Wind to HNAH Janet Burak and others, HSBC-PSI-PROD- 
0000508-016 at 509. 

1069 Global Payments System (GPS) Implementation Issues, 6 Aug 07 HUSI Audit Committee Update, HSBC OCC 
1105891. 

1070 8/01/2007 email from HBUS David Dew to Bandula Wijesinghe and others, OCC-PSI-00188404. 

1071 Subcommittee interview of David Dew (3/05/2012). 

1072 Subcommittee interview of Anne Liddy (2/22/2012). 

173 12/16/2009 internal Federal Reserve memorandum , BOG-A-207130. [Sealed Exhibit.] 



1074 Subcommittee briefing by HSBC legal counsel (6/27/2012). 
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C. Analysis 

OFAC enforces U.S. programs aimed at exposing and disabling the financial dealings and 
resources of some of the most dangerous persons and jurisdictions threatening the world today, 
including terrorists, persons involved with weapons of mass destruction, drug traffickers, and 
rogue jurisdictions. The OFAC filter is the central mechanism used to identify, stop, and block 
suspect transactions speeding through financial systems. Global financial institutions have a 
special responsibility to respect OFAC prohibitions and comply with OFAC restrictions. 
Actions taken to circumvent the OFAC filter or endanger the effectiveness of a critical safeguard 
may facilitate transactions undertaken by some of the worst wrongdoers among us. 

The evidence reviewed by the Subcommittee indicates that, from 2001 to 2007, HSBC 
affiliates, with the knowledge and tacit approval of HSBC Group executives, engaged in 
alarming conduct sending undisclosed Iranian U-turn transactions through their HBUS 
correspondent accounts, without information that would otherwise have triggered OFAC 
reviews. When asked, HBUS insisted on HSBC affiliates using transparent payment instructions 
so that all U-turn transactions would be stopped by the OFAC filter and reviewed, but when 
faced with evidence that some HSBC affiliates were acting to circumvent the OFAC filter, 
HBUS failed to take decisive action to stop the conduct some in its own organization viewed as 
deceptive. In addition, from at least 2009 to early 2012, the bank's OFAC compliance program 
suffered from multiple deficiencies. Still another issue is that some HSBC affiliates sent non- 
U.S. dollar messaging traffic through U.S. servers in which the OFAC screening was not turned 
on or was restricted. The aim in many of the instances in which HSBC affiliates acted to 
circumvent the OFAC filter may have been to avoid the time-consuming individualized reviews 
that followed, rather than execute prohibited transactions. But expediency in the face of the 
threats posed by the targets of OFAC prohibitions does not justify potentially violating or 
undermining OFAC requirements. HBUS likewise failed to obtain information about the full 
scope of undisclosed OFAC sensitive transactions going through its correspondent accounts, 
bring to a head the issue of HSBC affiliates circumventing OFAC safeguards, and ensure all 
transactions were reviewed for OFAC compliance. 
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V. ALRAJHIBANK: DISREGARDING LINKS TO TERRORIST 
FINANCING 

For decades, HSBC has been one of the most active global banks in Saudi Arabia, 
despite AML and terrorist financing risks involved with doing business in that country. 
Among other activities, for more than 25 years, HSBC has provided a wide range of 
banking services to Al Rajhi Bank, Saudi Arabia's largest private bank. 1075 Those 
services included providing large amounts of physical U.S. dollars to the bank as part of 
HSBC's U.S. banknotes business. After the 9-11 terrorist attack on the United States in 
2001, evidence began to emerge that Al Rajhi Bank and some of its owners had links to 
organizations associated with financing terrorism, including that one of the bank's 
founders was an early financial benefactor of al Qaeda. In January 2005, despite the fact 
that Al Rajhi Bank had not been indicted, designated a terrorist financier, or sanctioned 
by any country, HSBC Group Compliance recommended internally that, due to terrorist 
financing concerns, HSBC affiliates should sever ties with the bank. 

In response, some HSBC affiliates disregarded the recommendation and 
continued to do business with the bank, while others terminated their relationships but 
protested HSBC's decision and urged HSBC to reverse it. The protests continued despite 
a U.S. indictment the next month, in February 2005, of two individuals accused, among 
other matters, of cashing $130,000 in U.S. travelers cheques at Al Rajhi Bank in Saudi 
Arabia and smuggling the money to violent extremists in Chechnya. In May 2005, four 
months after its initial decision, HSBC Group Compliance reversed itself and announced 
that all HSBC affiliates could do business with Al Rajhi Bank, thus allowing HBUS to 
decide for itself whether to resume the relationship. For nearly two years, HSBC 
Banknotes repeatedly asked its AML Compliance personnel to allow reinstatement of the 
Al Rajhi Bank relationship, despite ongoing concerns at HBUS about the bank's possible 
links to terrorist financing. 

On December 1, 2006, despite concern that there is "no smoke without fire," 
HBUS AML Compliance agreed to allow HBUS to reinstate the relationship and resume 
supplying U.S. dollars to Al Rajhi Bank. Earlier, Al Rajhi Bank had threatened to pull all 
of its business from HSBC if the U.S. banknotes business were not restored, while HSBC 
personnel estimated that restoring the U.S. banknotes business would produce annual 
revenues of at least $100,000. In 2007, additional information surfaced about Al Rajhi 
Bank's possible links to terrorism, including articles on a 2003 report by the U.S. Central 
Intelligence Agency (CIA) entitled, "Al Rajhi Bank: Conduit for Extremist Finance," 
which found that "[s]enior al-Rajhi family members have long supported Islamic 
extremists and probably know that terrorists use their bank." Despite that and other 
troubling information, HBUS continued to supply U.S. dollars to the bank, and even 
expanded its business, until 2010, when HSBC decided, on a global basis, to exit the U.S. 
banknotes business. 



HSBC also operates an affiliate, HSBC Bank Middle East, with branches in Saudi Arabia; owns Saudi British 
Bank; and provides correspondent banking services to other Saudi financial institutions. 
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Al Rajhi Bank was not the only bank with links to terrorism serviced by HBUS. 
Two additional examples are Islami Bank Bangladesh Ltd. and Social Islami Bank which 
is also located in Bangladesh. In each case, in anticipation of revenues of $75,000 to 
$100,000 per year, HBUS Banknotes personnel disregarded troubling evidence of 
possible links to terrorist financing, opened accounts for the banks, and provided them 
with U.S. dollars and access to the U.S. financial system. 



A. Al Rajhi Bank 



Founded in 1957, Al Rajhi Bank is one of the largest banks in Saudi Arabia, with 
over 8,400 employees and assets totaling $59 billion. 1 7 Headquartered in Riyadh, the 
bank has over 500 branches, mostly in Saudi Arabia, but also in Malaysia, Kuwait, and 

1 077 

Jordan."'" The bank was founded by four brothers, Sulaiman, Saleh, Abdullah, and 
Mohamed, of the Al Rajhi family, one of the wealthiest in Saudi Arabia. 

The bank began as a collection of banking and commercial ventures which, in 

— 1 07 R 

1978, joined together as the Al Rajhi Trading and Exchange Company. In 1987, the 
company converted to a joint stock company, and two years later renamed itself the Al 
Rajhi Banking and Investment Corporation. 1079 In 2006, the bank rebranded itself as Al 
Rajhi Bank. 1080 It is traded on the Saudi Arabian Stock Exchange (Tadawul), and about 
45% of its shares are publicly owned. 1081 Al Rajhi family members remain the bank's 
largest shareholders. 1082 

Al Rajhi Bank offers a wide range of banking services including deposits, loans, 
investment advice, securities trading, remittances, credit cards, and consumer 
financing. luoJ All services are offered in conformance with Islamic requirements, 
including the set aside of funds for "zakat," which is used for charitable donations. The 
bank has won a number of awards for its operations in the Middle East. 

The bank's most senior official is Sulaiman bin Abdul Aziz Al Rajhi, who at 
various times has held the posts of Chief Executive Officer, Managing Director, and 
Chairman of the Board of Directors. 1084 The bank's General Manager is Abdullah bin 
Abdul Aziz Al Rajhi. The board of directors consists of eleven directors, six of whom 



1076 



Al Rajhi Bank website, "About Us," http://www.alrajhibank.com.sa/en/about-us/pages/default.aspx. 



1077 Id. 



Id; Al Rajhi Bank website, "Our History," http://www.alrajhibank.com.sa/our-history/index.html. 

1079 Al Rajhi Bank website, "Our History," http://www.alrajhibank.com.sa/our-history/index.html. 

1080 rpj^ ^ )an j c a j so nas var j ous subsidiaries, including Al Rajhi Capital. See Al Rajhi Capital website, 
http://www.alrajhi-capital.com/en/Welcome+to+ARFS/Overview/. 

1081 HBUS "Know Your Customer Profile" of Al Rajhi Banking & Investment Corp. (10/15/2010), HSBC-PSI-PROD- 
0102310, (hereinafter "2010 HBUS KYC Profile on Al Rajhi Bank"), at 2. About 45% of the bank's shares are 
publicly traded; the remainder is held primarily by members of the Al Rajhi family. Id. at 3. 

1082 2010 HBUS KYC Profile on Al Rajhi Bank at 3. 

1083 See Al Rajhi Bank website, http://www.alrajhibank.com.sa.aspx. 

1084 See Al Rajhi Bank website, "About Us," http://www.alrajhibank.com.sa/en/about-us/pages/board-of- 
directors.aspx. See also 2010 HBUS KYC Profile on Al Rajhi Bank at 3 (describing Sulaiman Abdul Aziz Al Rajhi 
as Chairman of the Board and Managing Director; Abdullah Sulaiman Al Rajhi as CEO; and Mohammed Lookman 
Samsudeen as General Manager and Chief Financial Officer). 
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are Al Rajhi family members: Sulaiman bin Abdul Aziz Al Rajhi, Chairman of the 
Board; Abdullah bin Abdul Aziz Al Rajhi; Sulaiman bin Saleh Al Rajhi; Mohamed bin 
Abdullah Al Rajhi; Abdullah bin Sulaiman Al Rajhi; and Bader bin Mohammed Al 
Rajhi. 1085 

The bank is part of an extensive group of Al Rajhi business and nonrpofit 
ventures, which include companies engaged in money exchange services, commodity 
trading, real estate, poultry, construction, and pharmaceuticals. 1086 One business which 
also had an HBUS account was the Al Rajhi Trading Establishment, a money exchange 
business owned by Abdulrahman Saleh Al Rajhi, Its HBUS account was closed in 
2005, when it merged with seven other businesses to form a new Saudi bank. The largest 
nonprofit venture in the Al Rajhi group is the SAAR Foundation, which is named after 
Sulaiman bin Abdul Azis Al Rajhi, and supports nonprofit and business ventures around 

1088 

the world. Sulaiman Al Rajhi and his family today have an estimated net worth of 
nearly $6 billion. 1089 

The Subcommittee contacted Al Rajhi Bank regarding its relationship to HSBC 
and the matters addressed in this section, but the bank has not provided any information 
in response to the Subcommittee's inquiry. 



B. Saudi Arabia and Terrorist Financing 



The majority of Al Rajhi Bank's operations take place in Saudi Arabia, which the 
United States has long identified as a country of concern in the area of terrorist 
financing. 1090 Following the terrorist attack on the United States on September 11, 2001, 
the U.S. government began a decade-long intensive investigation into where and how 
terrorists obtain funding, repeatedly returning to Saudi Arabia, its banks, and its nationals 
as a suspected source. 

In 2004, the 9/1 1 Commission charged with investigating the terrorist attack 
issued a report which found that Osama Bin Laden and al Qaeda had relied on a 
"financial support network that came to be known as the 'Golden Chain,' put together 
mainly by financiers in Saudi Arabia and the Persian Gulf states." 1091 The 
Commission's report explained: 



Rajhi Bank website, "About Us," http://www.alrajhibank.com.sa/en/about-us/pages/board-of-directors.aspx. 

1086 See, e.g., Sulimin Abdul Aziz Al Rajhi Holding Company website, http://www.alrajhiholding.com/. 

1087 See, e.g., March 2002 email chain among HBUS personnel, "Al Rajhi Trading establishment," OCC-PSI- 
00381727, at 3; 9/8/2008 HSBC Financial Investigations Group (FIG) report on Al Rajhi Bank, HSBC-PSI-PROD- 
0102813. 

1088 See "Sulaiman Al-Rajhi's life a rags to riches story," Arab News (5/29/2012), 
http://www.arabnews.com/?q=economy/sulaiman-al-rajhi%E2%80%99s-life-rags-riches-story. 

1089 See Profile of Sulaiman Al Rajhi & family (March 2012), Forbes , http://www.forbes.com/profile/sulaiman-al- 
rajhi/. See also 2010 HBUS KYC Profile on Al Rajhi Bank at 3 (estimating family worth at $22.5 billion). 

1090 See, e.g., International Narcotics Control Strategy Reports prepared by the U.S. Department of State, 2003-2012 
(identifying Saudi Arabia as a country "of concern" with respect to money laundering and terrorist financing). 

1091 The 9/11 Commission Report: Final Report of the National Commission on Terrorist Attacks upon the United 
States , (7/22/2004), at 55. 
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"Al Qaeda appears to have relied on a core group of financial facilitators who 
raised money from a variety of donors and other fund-raisers, primarily in the 
Gulf countries and particularly in Saudi Arabia. Some individual donors surely 
knew, and others did not, the ultimate destination of their donations." 1092 

The Commission report stated: "Saudi Arabia's society was a place where al Qaeda raised 
money directly from individuals and through charities. It was the society that produced 15 of the 
19 hijackers." 1093 The report also stated that it "found no evidence that the Saudi government as 
an institution or senior Saudi officials individually funded [Al Qaeda]," 1094 and that after terrorist 
attacks began occurring in Saudi Arabia, a "Saudi crackdown ... ha[d] apparently reduced the 
funds available to al Qaeda - perhaps drastically - but it is too soon to know if this reduction will 
last." 1095 



After several major terrorist attacks within its borders in 2003 and 2004, Saudi Arabia 
took a number of steps to combat terrorist financing. One report to Congress by the 
Congressional Research Service summarized those actions as follows: 

"Since mid-2003, the Saudi government has: set up a joint task force with the United 
States to investigate terrorist financing in Saudi Arabia; shuttered charitable organizations 
suspected of terrorist ties; passed anti-money laundering legislation; banned cash 
collections at mosques; centralized control over some charities; closed unlicensed money 
exchanges; and scrutinized clerics involved in charitable collections." 1096 

Saudi Arabia also reported seizing illicit cash from terrorist organizations, shutting suspect bank 
accounts, designating several individuals as terrorist financiers, and killing two of them. 1097 In 
addition, Saudi Arabia established a Permanent Committee on Combating the Financing of 
Terrorism and a Financial Investigation Unit which began operations in September 2005. 1098 

Despite those advances, U.S. government testimony and reports indicate that Saudi 
Arabia continued to be a focus of concern with respect to terrorist financing. In 2005, for 
example, U.S. Treasury Under Secretary for Terrorism and Financial Intelligence Stuart Levey 
testified before Congress: "[W]ealthy donors in Saudi Arabia are still funding violent extremists 
around the world, from Europe to North Africa, from Iraq to Southeast Asia." 1099 He also 



1092 Id. at 170. 

1093 Id. at 370. 

1094 Id.atl71. 

1095 Id. at 383. 

1096 "§ au( jj Arabia: Terrorist Financing Issues," Congressional Research Service Report for Congress, RL32499 
(9/14/2007), http://www.fas.org/sgp/crs/terror/RL32499.pdf (hereinafter "2007 CRS Report on Saudi Arabia 
Terrorist Financing Issues"), in the summary. See also 2007 International Narcotics Control Strategy Report, U.S. 
Department of State, at 355-357. 

1097 2007 CRS Report on Saudi Arabia Terrorist Financing Issues, at 25. 

1098 Id. at 24. 

1099 Stuart Levey testimony before the House Financial Services Subcommittee on Oversight and Investigations and 
House International Relations Subcommittee on International Terrorism and Nonproliferation (5/4/2005). 
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testified that Saudi individuals may be "a significant source" of financing for the Iraq 
insurgency. 1100 

In 2007, in its annual International Narcotics Control Strategy Report, the U.S. 
Department of State wrote: "Saudi donors and unregulated charities have been a major source of 
financing to extremist and terrorist groups over the past 25 years." 1101 A 2007 report to Congress 
by the Congressional Research Service stated: "U.S. officials remain concerned that Saudis 
continue to fund Al Qaeda and other terrorist organizations." 1102 That same year, Congress 
enacted legislation which found that "Saudi Arabia has an uneven record in the fight against 
terrorism, especially with respect to terrorist financing," and required the U.S. government to 
develop a long term strategy for working with Saudi Arabia to combat terrorist financing. 1103 On 
the sixth anniversary of the 9/1 1 attack, Treasury Under Secretary Levey said in a televised 
interview on terrorist financing: "[I]f I could somehow snap my fingers and cut off the funding 
from one country, it would be Saudi Arabia." 1104 

In 2008, the U.S. State Department issued the long-term strategy required by the 2007 
law. 1105 The strategy identified goals and "performance targets" to track progress in 
strengthening collaboration with Saudi Arabia to clamp down on terrorist financing. In April 
2008, when questioned during a Senate hearing, Treasury Under Secretary Levey testified that, 
while Saudi Arabia had taken strong action against terrorists operating within its borders and was 
cooperating with the United States on an operational level, it was not working as hard to prevent 
funds from flowing to terrorists outside of its borders: "Saudi Arabia today remains the location 
from which more money is going to terror groups and the Taliban - Sunni terror groups and the 
Taliban - than from any other place in the world." 1106 

In 2009, a report prepared for Congress by the U.S. Government Accountability Office 
(GAO) reviewed both the State Department's long-term strategy and Saudi anti-terrorism efforts 
since 2005. GAO concluded: "U.S. and Saudi officials report progress on countering terrorism 
and its financing within Saudi Arabia, but noted challenges, particularly in preventing alleged 
funding for terrorism and violent extremism outside of Saudi Arabia." 1107 GAO wrote: 

"U.S. officials remain concerned about the ability of Saudi individuals and multilateral 
charitable organizations, as well as other individuals visiting Saudi Arabia, to support 



Stuart Levey testimony before the Senate Committee on Banking, Housing, and Urban Affairs (7/13/2005) 
("Wealthy Saudi financiers and charities have funded terrorist organizations and causes that support terrorism and 
the ideology that fuels the terrorists' agenda. Even today, we believe that Saudi donors may still be a significant 
source of terrorist financing, including for the insurgency in Iraq."). 

1101 2007 International Narcotics Control Strategy Report, U.S. Department of State, at 355. 

1102 2007 CRS Report on Saudi Arabia Terrorist Financing Issues, in the summary. 

1103 See Section 2043(c), Implementing Recommendations of the 9/11 Commission Act, P.L. 110-53 (8/3/2007). 

1104 "U.S.: Saudis Still Filling Al Qaeda's Coffers," Brian Ross, ABC News (9/1 1/ 2007). 

1105 "jj g Strategy Toward Saudi Arabia, Report Pursuant to Section 2043(c) of the Implementing 
Recommendations of the 9/1 1 Commission Act," U.S. Department of State (1/30/2008). 

1 106 Stuart Levey testimony before Senate Committee on Finance, "Anti-Terrorism Financing: Progress Made and 
Challenges Ahead," (4/1/2008). 

1107 "Combating Terrorism: U.S. Agencies Report Progress Countering Terrorism and Its Financing in Saudi 
Arabia, but Continued Focus on Counter Terrorism Financing Efforts Needed." U.S. Government Accountability 
Office, GAO-09-883 (Sept. 2009), http://www.gao.gov/new.items/d09883.pdf, at 1. 
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terrorism and violent extremism outside of Saudi Arabia. U.S. officials also noted that 
limited Saudi enforcement capacity and terrorist financiers' use of cash couriers pose 
challenges to Saudi efforts to prevent financial support to extremists." 1108 

GAO also noted that certain performance targets set by the State Department had been dropped 
in 2009, such as the establishment of a Saudi Commission on Charities to oversee actions taken 
by Saudi charities abroad as well as certain regulations of cash couriers. 1109 GAO recommended 
that the United States reinstate the dropped performance targets to prevent the flow of funds 
from Saudi Arabia "through mechanisms such as cash couriers, to terrorists and extremists 
outside Saudi Arabia." 1110 

Recently, Saudi Arabia won praise for its role in foiling a terrorist plan to smuggle a 
bomb onto an airline flight to the United States. 1111 The State Department's most recent annual 
International Narcotics Control Strategy Report contains no information about Saudi Arabia's 

11 12 

anti-money laundering or terrorist financing efforts. 
C. Alleged Al Raj hi Links to Terrorism 

In the ten years after the 9-11 attack in 2001, U.S. government reports, criminal 
and civil legal proceedings, and media reports have alleged links between Al Rajhi family 
members and the Al Rajhi Bank to terrorist financing. The alleged links include that 
some Al Rajhi family members were major donors to al Qaeda or Islamic charities 
suspected of funding terrorism, established their own nonprofit organizations in the 
United States that sent funds to terrorist organizations, or used Al Rajhi Bank itself to 
facilitate financial transactions for individuals or nonprofit organizations associated with 
terrorism. 

Many of the suspicions regarding Al Rajhi Bank stem from 2002, when the name of its 
most senior official, Sulaiman bin Abdul Azis Al Rajhi, appeared on an internal al Qaeda list of 
financial benefactors, and when a network of Al Rajhi-related nonprofit and business ventures 
located in Virginia was subjected to search by U.S. law enforcement seeking to disrupt terrorist 
financing activities in the United States. 

Al Qaeda List of Financial Benefactors. The al Qaeda list of financial benefactors 
came to light in March 2002, after a search of the Bosnian offices of the Benevolence 
International Foundation, a Saudi based nonprofit organization which was also designated a 
terrorist organization by the Treasury Department, led to seizure of a CD-ROM and computer 

11 13 

hard drive with numerous al Qaeda documents. One computer file contained scanned images 



1108 Id. at 29. 

1109 Id. at 15, 33. 

1110 Id. at 3. 

1111 See, e.g., "International sting operation brought down underwear bomb plot," Los Angeles Times , Brian Bennett 
and Ken Dilanian (5/8/2012), http://latimesblogs.latimes.com/world now/2012/05/underwear-bomb-plot.html. 

1112 , 



2012 International Narcotics Control Strategy Report, Volume II Country Database, U.S. Department of State, at 
287-289. 

1113 See United States v. Enaam Arnaout , Case No. 02-CR-892 (USDC NDIL), "Government's Evidentiary Proffer 
Supporting the Admissibility of Coconspirator Statements," (1/6/2003), 
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of several hundred documents chronicling the formation of al Qaeda. 1114 One of the scanned 
documents contained a handwritten list of 20 individuals identified as key financial contributors 
to al Qaeda. 1115 Osama bin Laden apparently referred to that group of individuals as the "Golden 
Chain." 1116 In a report prepared for Congress, the Congressional Research Service explained: 

"According to the Commission's report, Saudi individuals and other financiers 
associated with the Golden Chain enabled bin Laden and Al Qaeda to replace lost 
financial assets and establish a base in Afghanistan following their abrupt departure from 
Sudan in 1996." 1117 

One of the 20 handwritten names in the Golden Chain document identifying al Qaeda' s early key 
financial benefactors is Sulaiman bin Abdul Aziz Al Rajhi, one of Al Rajhi Bank's key founders 

1118 

and most senior officials. 

The Golden Chain document has been discussed in the 9-11 Commission's report, in 
federal court filings, and civil lawsuits. 1119 Media reports as early as 2004 noted that the al 
Qaeda list included the Al Rajhi name. 1120 HSBC was clearly on notice about both the al Qaeda 
list and its inclusion of Sulaiman bin Abdul Aziz Al Rajhi. 11 1 



http://fll.findlaw.com/news.findlaw.com/wsj/docs/bif/usarnaoutl0603prof.pdf (hereinafter "Arnaout Evidentiary 
Proffer"), at 29. See also 2007 CRS Report on Saudi Arabia Terrorist Financing Issues, at 3; "Terrorism, 2002- 
2005," FBI report, at 12, http://www.fbi.gov/stats-services/publications/terrorism-2002-2005/terror02_05.pdf ("On 
August 18, 2003, Enaam Arnaout, the director of Benevolence International Foundation, was sentenced to 1 1 years 
in federal prison after pleading guilty on February 10, 2003, to terrorism-related racketeering conspiracy charges. 
Arnaout had been indicted on October 9, 2002, for conspiracy to fraudulently obtain charitable donations in order to 
provide financial assistance to al-Qa'ida and other organizations engaged in violence and terrorism."). 
11 14 Arnaout Evidentiary Proffer at 29. 

1115 Id. at 30. 

1116 Id. at 30. See also 2007 CRS Report on Saudi Arabia Terrorist Financing Issues," at footnote 6. But see 
"Tangled Paths: A Sprawling Probe Of Terror Funding Centers in Virginia," Wall Street Journal , Glenn Simpson 
(6/21/2004)("Soon thereafter, a senior al Qaeda leader held by the Justice Department in New York confirmed the 
document's authenticity in an interview with the FBI, referring to it as the Golden Chain, U.S. government court 
filings say."). 

1117 2007 CRS Report on Saudi Arabia Terrorist Financing Issues," at 3. 

1118 A copy of the Golden Chain document was provided as Exhibit 5 to the Arnaout Evidentiary Proffer. Copies 
have also appeared on the Internet with English translations. See, e.g., "The Golden Chain," Wikipedia, 
http://en.wikipedia.org/wiki/The_Golden_Chain. 

1119 See The 9/1 1 Commission Report: Final Report of the National Commission on Terrorist Attacks upon the 
United States , (7/22/2004), at 55. See also, e.g., Arnaout Evidentiary Proffer at 29-30; The Underwriting Members 
of Lloyd's Syndicate 3500 v. Saudi Arabia . Case 3:1 1 -cv-00202-KRG (USDC WDPA), Civil Complaint (9/8/1 1), 
http://www.investigativeproject.org/documents/case_docs/1680.pdf , at 20. 

1120 See, e.g., "Tangled Paths: A Sprawling Probe Of Terror Funding Centers in Virginia," Wall Street Journal , 
Glenn Simpson (6/21/2004). 

1121 See, e.g., 7/26/2007 email from OCC Joseph Boss to HBUS Alan Ketley, "Saudi' s," HSBC OCC 2830874-879 
(transmitting 2007 Wall Street Journal article to HBUS and requesting its response); 2/3/2010 email from 
HBUS Jon K. Jones to HBUS Ali S. Kazmy, "Islami Bank Bangladesh Ltd. - Poss SCC," OCC-PSI- 
00453499 ("Al-Rajhi Bank got [its] start as a money chaining network and (Chairman Suleiman al-Rajhi 
appeared on the 'Golden Chain' of wealthy investors who supported Osama bin Laden.)"). 
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2002 Search Warrant. Also in March 2002, as part of Operation Green Quest, a 

1 122 

U.S. Treasury effort to disrupt terrorist financing activities in the United States, U.S. 
law enforcement agents conducted a search of 14 interlocking business and nonprofit 
entities in Virginia associated with the SAAR Foundation, an Al Rajhi-related entity, and 

1 123 

the Al Rajhi family. Over 150 law enforcement officers participated in the search, 
generating widespread media coverage. 1124 A law enforcement affidavit supporting the 
search warrant detailed numerous connections between the targeted entities and Al Rajhi 

1 125 

family members and related ventures. The affidavit stated that over 100 active and 
defunct nonprofit and business ventures in Virginia were part of what it described as the 
"Safa Group," 1126 which the United States had reasonable cause to believe was "engaged 
in the money laundering tactic of 'layering' to hide from law enforcement authorities the trail 
of its support for terrorists." 1127 

The SAAR Foundation is a Saudi-based nonprofit organization, founded by 
Sulaiman bin Abdul Aziz Al Rajhi in the 1970s, named after him, and used by him to 
support a variety of nonprofit endeavors, academic efforts, and businesses around the 
world. In 1983, the SAAR Foundation formed a Virginia corporation, SAAR 
Foundation, Inc., and operated it in the United States as a tax-exempt nonprofit 

1 128 

organization under Section 501(c)(3) of the U.S. tax code. In 1996, another nonprofit 
organization was incorporated in Virginia called Safa Trust Inc. 1129 These and other 
nonprofit and business ventures associated with the Al Rajhi family shared personnel and 
office space, primarily in Herndon, Virginia. In 2000, SAAR Foundation Inc. was 
dissolved, 1130 but the Safa Trust continued to operate. 

An affidavit filed by the United States in support of the search warrant alleged that the 
Safa Group appeared to be involved with providing material support to terrorism. Among other 
matters, it alleged that members of the Safa Group had transferred "large amounts of funds . . . 
directly to terrorist- front organizations since the early 1990's," including a front group for the 
Palestinian Islamic Jihad-Shikaki Faction, a designated terrorist organization. 1131 It also detailed 
a $325,000 donation by the Safa Trust to a front group for Hamas, another designated terrorist 
organization. 1132 In addition, the affidavit expressed suspicion about a transfer of over $26 

1 133 

million from members of the Safa Group to two offshore entities in the Isle of Man. The 



1122 See "Operation Green Quest Overview," U.S. Customs and Border Protection press release (2/26/2002), 
http://www.cbp.gov/xp/cgov/newsroom/news_releases/archives/legacy/2002/22002/02262002.xml. 

1123 See "Affidavit in Support of Application for Search Warrant," In Re Searches Involving 555 Grove Street, 
Herndon, Virginia and Related Locations , (USDC EDVA), submitted by David Kane, Senior Special Agent, U.S. 
Customs Service (hereinafter "Kane affidavit"), at ff 3-4 (describing investigation). 

1124 See, e.g., "Raids Seek Evidence of Money Laundering," New York Times , Judith Miller (3/21/2002). 

1125 See Kane affidavit throughout, but in particular f|[ 178-180. 

1 126 Kane affidavit at <][ 1 (page 6). 

1127 Kane affidavit at<][5. 

1128 Kane affidavit atf 132. 

1129 Kane affidavit at f][ 135-136. 

1130 Kane affidavit at 1[ 132. See also "Raids Seek Evidence of Money Laundering," New York Times , Judith Miller 
(3/21/2002)(stating that, "although officially dissolved," the SAAR Foundation had recently occupied the Virginia 
offices subject to search). 

1131 Kane affidavit at 13. 

1132 Kane affidavit atf][ 10(g), 161. Executive Order 12947 (1995). 

1133 Kane affidavit at f <][ 103-104. 
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affidavit further alleged that "one source of funds flowing through the Safa Group [was] from the 
wealthy Al-Rajhi family in Saudi Arabia." 1134 

The search produced about 200 boxes of information which was then analyzed and used 
in other investigations and prosecutions, although neither the SAAR Foundation or Safa Trust 

1 1 35 

has been charged with any wrongdoing. In 2003, Abdurahman Alamoudi, who had worked 
for SAAR Foundation Inc. from 1985 to 1990, as executive assistant to its president, 1136 pled 
guilty to plotting with Libya to assassinate the Saudi crown prince and was sentenced to 23 years 

1137 

in jail. He had also openly supported Hamas and Hezbollah, two terrorist organizations 

1138 

designated by the United States. According to an affidavit supporting the criminal complaint 
against him, Mr. Alamoudi admitted receiving $340,000 in sequentially numbered $100 bills 
from Libya while in London, 1 and planned "to deposit the money in banks located in Saudi 
Arabia, from where he would feed it back in smaller sums into accounts in the United States." 1140 
According to the affidavit, he also admitted involvement in similar cash transactions involving 
sums in the range of $10,000 to $20,000. 1141 

The documents seized in the 2002 search were returned after about 18 months, but in 
2006, were sought again through subpoenas issued by a federal grand jury in Virginia. 1142 The 
Al-Rajhi related business and nonprofit ventures initially refused to re-supply the documents, 
then turned them over after a court imposed civil contempt fines totaling $57,000. 1 The Al 
Rajhi group then engaged in a four- year, unsuccessful court battle to nullify the fines. 1144 In 
addition, in 2004, Al Rajhi Bank filed a defamation lawsuit against the Wall Street Journal for a 
2002 article describing how Saudi Arabia was monitoring certain accounts due to terrorism 
concerns. 1145 In 2004, the lawsuit settled; the Wall Street Journal did not pay any damages. It 
also published a letter from the bank's chief executive, 1146 and its own statement that the 
newspaper "did not intend to imply an allegation that [Al Rajhi Bank] supported terrorist 
activity, or had engaged in the financing of terrorism." 1147 



1134 Kane affidavit at f 1 1 1 (emphasis in original omitted). 

1135 See In re Grand Jury Subpoena (T-l 12) , 597 F.3d 189 (4th Cir. 2/24/2010), at 191-192. 

1136 See United States v. Alamoudi , (USDC EDVA)(9/30/2003), "Affidavit in Support of Criminal Complaint," 
submitted by Brett Gentrup, Special Agent with U.S. Immigration and Customs Enforcement, (hereinafter "Gentrup 
affidavit"), 1 29. 

1137 See "Abdurahman Alamoudi Sentenced to Jail in Terrorism Financing Case," press release prepared by U.S. 
Department of Justice (10/15/2004). 

1138 See Gentrup affidavit at 1 35. 

1139 Gentrup affidavit at <][<][ 39, 43 

1140 Gentrup affidavit at 1[ 44. 

1141 Gentrup affidavit at 1[ 45. 

1142 See In re Grand Jury Subpoena (T-l 12) , 597 F.3d 189 (4th Cir. 2/24/2010). 

1143 Id. 

1144 Id. See also "A Court Sheds New Light on Terror Probe," The New York Sun , Joseph Goldstein (3/24/2008). 

1145 The article was "Saudis Monitor Key Bank Accounts For Terror Funding at U.S. Request," Wall Street Journal , 
James Dorsey (2/6/2002), http://online.wsj.com/article/SB109813587680048521.html. 

H46 < t ^j £ a jjjj B^k's Statement on Journal's Article," Wall Street Journal , Abdullah Sulaiman Al Rajhi 
(10/19/2004), http://online.wsj.com/article/SB109813521879148492.html. 

1147 HSBC Financial Intelligence Group Report of Findings on Al Rajhi Bank, HSBC OCC 7519413 (12/13/2004). 
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2003 CIA Report. While the widely publicized 2002 search fueled suspicions about Al 
Rajhi Bank's association with terrorist financing, a 2003 CIA report, discussed in a news article 
in 2007, provided another basis for concerns about the bank. 

In 2003, the U.S. Central Intelligence Agency (CIA) issued a classified report 
entitled, "Al Rajhi Bank: Conduit for Extremist Finance." 1148 According to Wall Street 
Journal reporter, Glenn Simpson, this CIA report concluded: "Senior Al Rajhi family 
members have long supported Islamic extremists and probably know that terrorists use 
their bank." 1149 A later civil lawsuit, filed in 201 1, provided a longer quotation from the 
same CIA report as follows: 

"Islamic extremists have used Al-Rajhi Banking & Investment Corporation (ARABIC) 
since at least the mid-1990s as a conduit for terrorist transactions, probably because they 
find the bank' s vast network and adherence to Islamic principles both convenient and 
ideologically sound. Senior al-Rajhi family members have long supported Islamic 
extremists and probably know that terrorists use their bank. Reporting indicates that 
senior al-Rajhi family members control the bank's most important decisions and that 
ARABIC'S principal] managers answer directly to Suleiman. The al-Rajhis know they 
are under scrutiny and have moved to conceal their activities from financial regulatory 
authorities." 1150 



According to the same Wall Street Journal article by Glenn Simpson, the 2003 
CIA report alleged that, in 2000, Al Rajhi Bank couriers "delivered money to the 
Indonesian insurgent group Kompak to fund weapons purchases and bomb-making 
activities." 1 151 The report also allegedly claimed that in 2002, one year after the 9/1 1 
attacks, the bank's managing director ordered the Al Rajhi Bank's board "to explore 
financial instruments that would allow the bank's charitable contributions to avoid 
official Saudi scrutiny." 1152 The 2003 CIA report allegedly stated further that extremists 
"ordered operatives in Afghanistan, Indonesia, Pakistan, Saudi Arabia, Turkey, and 
Yemen" to use Al Rajhi Bank. 1153 

2005 Al Haramain Prosecution. A third source of suspicion regarding Al Rajhi Bank's 
possible links to terrorism arose from a 2005 federal indictment of al-Haramain Islamic 
Foundation Inc. and two of its senior officials. Al-Haramain Islamic Foundation is a Saudi- 
based nonprofit organization that, in 2005, operated in more than 50 countries around the 
world. 1154 Beginning in 2002, the United States designated multiple branches of the Foundation 



1148 „ us Tracks Saudi Bank Favored by Extremists," Wall Street Journal , Glenn Simpson (7/26/2007), 
http://online.wsj.com/article/SB118530038250476405.html. 

1149 Id. 

1150 The Underwriting Members of Lloyd's Syndicate 3500 v. Saudi Arabia , Case 3:1 1 -cv-00202-KRG (USDC 
WDPA), Civil Complaint (9/8/2011), http://www.investigativeproject.org/documents/case_docs/1680.pdf 
(hereinafter "Lloyd's lawsuit"), at1[ 370. 

1151 ,< us Tracks Saudi Bank Favored by Extremists," Wall Street Journal , Glenn Simpson (7/6/2007), 
http://online.wsj.com/article/SB118530038250476405.html. 

1152 Id. 

1153 Id. 

1154 United States v. al-Haramain Islamic Foundation Inc. , Case No. 6:05-CR-60008-HO (USDC Oregon) 
Indictment (2/17/2005) at KB. 
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as terrorist organizations. After freezing the assets of two such branches for "diverting 
charitable funds to terrorism," a U.S. Treasury Department press release stated: "The branch 
offices of al Haramain in Somalia and Bosnia are clearly linked to terrorist financing." 1156 In 
2004, a Treasury Department statement called al-Haramain Foundation "one of the principal 
Islamic NGOs [Non-Governmental Organizations] providing support for the Al Qaida network 

1 157 

and promoting militant Islamic doctrine worldwide." That same year, the United States 
added the U.S. branch of the organization to the SDN list for acting as an "underwrit[er] of 

1158 

terror."- The Saudi government issued a similar 2004 designation and ordered the al- 
Haramain Islamic Foundation to be dissolved. 1159 In 2008, however, Treasury noted that, despite 
the Saudi government's action, the organization's leadership appeared to have reconstituted itself 
under a new name and continued to operate. 1160 

In the United States, representatives of the al-Haramain Islamic Foundation formed, in 
1999, an Oregon corporation named al-Haramain Islamic Foundation, Inc. which set up offices 
in Ashland, Oregon. 1161 The corporation was operated as a nonprofit organization under Section 
501(c)(3) of the U.S. tax code. 1162 In 2004, the Office of Foreign Assets Control (OFAC) at the 
Treasury Department deemed al-Haramain Islamic Foundation Inc. in Oregon a "Specially 
Designated Global Terrorist Entity." 1163 In 2005, the United States indicted the Foundation and 
two of its senior officials, Pirouz Sedaghaty and Soliman Al-Buthe who was later designated by 
the United States as a terrorist financier. 1164 Since both men were out of the country when the 
indictment was filed, the case was dormant for two years. 1165 In 2007, Mr. Sedaghaty returned to 



See "Blocking Property and Prohibiting Transactions With Persons Who Commit, Threaten To Commit, or 
Support Terrorism," 66 FR 49079 (9/23/2001). 

1156 3/1 1/2002 "Designations of Somalia and Bosnia-Herzegovina Branches of Al-Haramain Islamic Foundation," 
U.S. Treasury Department, http://www.fas.org/irp/news/2002/03/dot031102fact.html. 

1157 " r p reasur y Announces Joint Action with Saudi Arabia Against Four Branches of al-Haramain In The Fight 
Against Terrorist Financing," U.S. Treasury Department press release No. JS-1 108 (1/22/2004), 
http://www.treasury.gov/press/releases/jsll08.htm. 

1158 See Executive Order No. 13,224 (2004); "U.S. -Based Branch of Al Haramain Foundation Linked to Terror," 
U.S. Treasury Department press release (1 1/9/2004). 

1159 See, e.g., 2007 CRS Report on Saudi Arabia Terrorist Financing Issues, at 19. 

11 See "Combating Terrorism: U.S. Agencies Report Progress Countering Terrorism and Its Financing in Saudi 
Arabia, but Continued Focus on Counter Terrorism Financing Efforts Needed." U.S. Government Accountability 
Office, GAO-09-883 (Sept. 2009), http://www.gao.gov/new.items/d09883.pdf, at 35. 

1161 See United States v. al-Haramain Islamic Foundation Inc. , Case No. 6:05-cr-60008-HO (USDC Oregon) 
Indictment (2/17/2005) at KB. 

1162 Id. 

1163 See Executive Order No. 13224 (2004); "U.S.-Based Branch of Al Haramain Foundation Linked to Terror," 
U.S. Treasury Department press release (1 1/9/2004); Al Haramain Islamic Foundation Inc. v. U.S. Dep't of 
Treasury , 660 F.3d 1019, 1023 (9th Cir. 201 1). 

1164 See United States v. al-Haramain Islamic Foundation Inc. , Case No. 6:05-CR-60008-HO (USDC Oregon) 
Indictment (2/17/2005). The case was featured in the U.S. State Department's annual report on money laundering 
issues. See 2005 International Narcotics Control Strategy Report, Volume II, "Money Laundering and Financial 
Crimes," U.S. State Department, at 16. See also "U.S.-Based Branch of Al Haramain Foundation Linked to Terror," 
U.S. Treasury Department press release No. JS-1895 (9/9/2004); "Tax Case Ends Against Charity," Les Zaitz, The 
Oregonian (8/5/2005). 

1165 Because neither individual was in the United States, the prosecution later dropped the Foundation from the case, 
to prevent the case from proceeding in a piecemeal fashion. See Al Rajhi Banking & Investment Corp. v. Holder , 
Case No. l:10-MC-00055-ESH, Memorandum of Points and Authorities In Support of Petitioner's Motion to Quash 
USA Patriot Act Subpoena (1/19/2010), at 5. 
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the United States and was arrested at an airport. 1166 In 2010, he stood trial, was convicted of two 
felonies, and sentenced to nearly three years in prison. 1167 In the incident that led to his 
conviction, he and Mr. Al-Buthe used funds from an Egyptian donor to purchase $130,000 in 
U.S. travelers cheques from a bank in Oregon; Mr. Al-Buthe then traveled to Saudi Arabia and, 
in 2000, cashed the travelers cheques at Al Rajhi Bank; the money was then smuggled to violent 
extremists in Chechnya. 1168 

Al Rajhi Bank's role in the events that formed the basis for the prosecution attracted 
media attention in 2005, when the indictment was filed; in 2007, when Mr. Sedaghaty was 
arrested; and in 2010, when the trial took place. Over the years, it became public that Mr. Al- 
Buthe, a designated terrorist financier, had been a client of Al Rajhi Bank in Saudi Arabia in 
2000, 1169 as had the al-Haramain Islamic Foundation, later designated a terrorist organization. 1170 
In 2007, a Wall Street Journal article reported that Al Rajhi Bank had maintained at least 24 

1171 

accounts for the al-Haramain Islamic Foundation and handled unusual transactions for it. In 
January 2010, after the United States served an administrative subpoena on Al Rajhi Bank to 
obtain authenticated bank documents for use in the al-Haramain Foundation criminal trial, the 

1 172 

bank refused to produce them and filed a motion in court to quash the subpoena, leading to 
media reports that it was refusing to cooperate with a terrorist financing prosecution. 1173 

Links to Suspect Banks. In addition to the Golden Chain document, the U.S. search of 
Al-Rajhi related businesses and nonprofits in the United States, and the al Haramain Foundation 
prosecution, still another source of concern about Al Rajhi Bank involves its alleged links to 
other banks suspected of financing terrorism. 

In 201 1, a civil lawsuit filed by an insurance syndicate against Saudi Arabia and others 
seeking to recover insurance payments made after the 9-11 terrorist attack discussed two of those 



1166 Id. 

1167 "Former U.S. Head of Al-Haramain Islamic Foundation Sentenced to 33 Months in Federal Prison," U.S. 
Attorney's Office for the District of Oregon press release (9/27/1 1) at 1. 

1168 Id. 

1169 See, e.g., Al Rajhi Banking & Investment Corp. v. Holder , Case No. l:10-MC-00055-ESH, Memorandum of 
Points and Authorities In Support of Petitioner's Motion to Quash USA Patriot Act Subpoena (filed 1-19-10), at 6. 

1170 See, e.g., "U.S. Tracks Saudi Bank Favored by Extremists," Wall Street Journal, Glenn Simpson (7/26/2007), 
http://online.wsj.com/article/SBl 18530038250476405.html. See also 7/26/2007 email from OCC Joseph Boss to 
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1171 « us Tracks Saudi Bank F avore( } by Extremists," Wall Street Journal , Glenn Simpson (7/26/2007), 
http://online.wsj.com/article/SBl 18530038250476405.html. 

1172 See Al Rajhi Banking & Investment Corp. v. Holder , Case No. l:10-MC-00055-ESH, Memorandum of Points 
and Authorities In Support of Petitioner' s Motion to Quash USA Patriot Act Subpoena (1/19/2010). This case was 
later closed as "moot." See Order Dismissing Action As Moot (3/2/2010) ("It is hereby ordered that this action is 
dismissed as moot in light of the ruling issued on February 26, 2010, by Judge Michael R. Hogan of the U.S. District 
Court for the District of Oregon in United States v. Sedaghaty.. .granting the government's motion to compel 
petitioner Al-Rajhi Banking and Investment Corp.'s compliance with an administrative subpoena.") (emphasis in 
original omitted). 

1173 See, e.g., "Saudi Bank Refuses to Cooperate in U.S. Investigation into Terrorist Financiers," For The Record - 
The IPT Blog (1/26/2010), http://www.investigativeproject.org/1753/saudi-bank-refuses-to-cooperate-in-us. 
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suspect banks, Bank al Taqwa and Akida Bank Private Ltd. 1174 Both banks have been deemed 

1 175 

by the United States as Specially Designated Global Terrorist Entities. Regarding Bank al 
Taqwa, the lawsuit noted that two individuals who were former executives at Bank al Taqwa, 
Ibrahim Hassabella and Samir Salah, were also associated with the SAAR Foundation. 1176 Mr. 
Hassabella was a former secretary of al Taqwa Bank and a shareholder of SAAR Foundation Inc. 
Mr. Saleh was a former director and treasurer of the Bahamas branch of al Taqwa Bank, and 
president of the Piedmont Trading Corporation which was part of the SAAR network. The U.S. 
Treasury Department has stated: "The Al Taqwa group has long acted as financial advisers to al 

1 177 

Qaeda, with offices in Switzerland, Lichenstein, Italy and the Caribbean." Regarding Akida 
Bank, the lawsuit complaint alleged that Sulaiman bin Abdul Aziz Al Rajhi was "on the board of 
directors of Akida Bank in the Bahamas" and that "Akida Bank was run by Youssef Nada, a 

1 178 

noted terrorist financier." 



As explained below, Al Rajhi Bank was also associated with Islami Bank Bangladesh 
Ltd., which was located in a country at high risk for money laundering, provided an account to a 
Bangladeshi accused of involvement with a terrorist bombing, and had been fined three times for 
violating AML requirements in connection with providing bank services to "militants." 1179 
HSBC's own research indicated that the Al Rajhi group held about one-third of the bank's 
shares. In addition, Al Rajhi Bank provided a correspondent account to Social Islami Bank, a 
Bangladesh-based bank whose largest single shareholder for many years was the International 
Islamic Relief Organization, which was designated by the United States in 2006, as a terrorist 
organization. 1180 A second shareholder was the precursor to the Benevolence Islamic 
Foundation, also later designated by the United States as a terrorist organization. 

Suspect Bank Clients. A final source of concern about Al Rajhi Bank involves accounts 
it provided to specific clients linked to terrorism. The accounts provided to the al-Haramain 
Islamic Foundation and Soliman Al-Buthe, both designated by the United States as linked to 
terrorism, have already been discussed. Another example is the International Islamic Relief 
Organization (IIRO) which, as mentioned earlier, is a Saudi-based nonprofit organization which 
was added to the SDN list by the United States for "facilitating fundraising for Al Qaida and 
affiliated terrorist groups". 1181 In 2003, HSBC's internal Financial Intelligence Group (FIG) 



See Lloyd's lawsuit at "H 459-460. This lawsuit was withdrawn 1 1 days after being filed, with no prejudice 
against its re-filing in the future. See Lloyd's lawsuit, Notice of Voluntary Dismissal, Docket document 5, 
9/19/2011. 

1175 See "The United States Designates Twenty-Five New Financiers of Terror," U.S. Treasury Department press 
release (8/29/2002), http://www.treasury.gov/press-center/press-releases/Pages/po3380.aspx. See also E.O. 13224, 
"Blocking Property and Prohibiting Transactions With Persons Who Commit, Threaten To Commit, or Support 
Terrorism," 66 FR 49079 (9/23/2001); Kane affidavit at f 1 12. 

1176 Lloyd's lawsuit at f 459. 

1177 Statement by Treasury Secretary Paul O'Neill (1 1/7/2001). 

1178 Lloyd's lawsuit at f 459. Youssef Nada was designated as a terrorist financier by the United States in November 
2001. See "Recent OF AC Actions," U.S. Department of the Treasury, (11/7/2001), 
http://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/2001 1 107.aspx. 

1179 See Subsection (i), below. 

1180 See Subsection (i), below. See also "Islamic Charity Charged with Terrorist Financing," U.S. Justice 
Department, (1/16/2008), http://www.justice.gov/usao/mow/news2008/iara.ind2.htm. 

1181 See 8/3/2006 press release, "Treasury Designates Director, Branches of Charity Bankrolling Al Qaida Network," 
U.S. Treasury Department, reprinted in 8/3/2006 email from HBUS Sharyn Malone to HBUS Stephanie Napier and 
others, "Social Investment Bank, Bangladesh," HSBC OCC 3259936. See also 8/3/2006 "Treasury Takes 
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raised questions about the IIRO; in 2006 a FIG report noted that the IIRO had been linked to Al 
Qaeda and other terrorist groups, plots to assassinate President Bill Clinton and the Pope, attacks 

1 1 82 

on the Brooklyn Bridge and Lincoln Tunnel, and the 1993 attack on the World Trade Center. 
According to a CRS report, press reports indicated that, until at least December 2004, the IIRO 
had arranged for donors to send donations directly to accounts it held at Al Rajhi Bank, 

1183 

advertizing the accounts in various publications. In addition, the Lloyd's lawsuit alleged that 
Al Rajhi Bank made or arranged for large donations to the IIRO. 1184 Sulaiman bin Abdul Aziz 
Al Rajhi, the most senior official at Al Rajhi Bank, is also alleged to have been an officer of 
IIRO. 1185 



Al Rajhi Bank gained notoriety as well for providing banking services to several of the 
hijackers in the 9-11 terrorist attack, including Abdulaziz al Omari who was aboard American 
Airlines Flight 11. A civil lawsuit described the bank's involvement with him as follows: 

"[M]oney was funneled to the Hamburg, Germany al Qaeda cell through the Al Rajhi 
Bank to businessmen Mahmoud Darkazanli and Abdul Fattah Zammar, who in turn 
provided the al Qaeda cell of September 1 1 th hijackers with financial and logistical 
support. Through Al Rajhi Bank, September 1 1 th hijacker Abdulaziz al Omari received 
funds into his Al Rajhi Bank Account Number .... Al Omari frequently utilized a credit 
card drawn on Al Rajhi Bank in the planning of the attacks. On September 7, 2001, four 
days before the 9/1 1 attacks, al Omari received a wire transfer from Al Rajhi Bank, 
Buraidah Branch, Jeddah, Saudi Arabia ...," 1186 

Taken together, the information - the Al Qaeda Golden Chain document, the 2002 
search of Al Rajhi-related entities in Virginia, the 2003 CIA report, the 2005 al Haramain 



Additional Measures to Combat Iranian WMD Proliferation Iranian Nuclear & Missile Firms Targeted," Treasury 
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1183 See, e.g., 2007 CRS Report on Saudi Arabia Terrorist Financing Issues, at 9, footnote 35 (citing International 
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publications, and Al Rajhi Bank advertised sending donations to IIRO accounts at the bank in the Al Igatha Journal 
in several countries). 

1184 Lloyd's lawsuit at f 446-448 (alleging "Al Rajhi Bank collected charitable donations on behalf of Sanabel al 
Kheer ("Seeds of Charity"), the financial/investment arm of the IIRO, depositing the donations into Sanabel's Al 
Rajhi Bank account no. 77707. . . . Under the guise of IIRO funds labeled and designated for purposes such as 'war 
and disaster' (Account number for Immigrants, Refugees, and Victims of Disasters: 77702) or 'sponsor a child' 
(IIRO Account Number of Deprived Children: 77704), charitable organizations such as the IIRO use banks like Al 
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1185 See, e.g., Lloyd's lawsuit at f 9. 
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Foundation indictment and trial, the 2007 media reports, the 2010 refusal to provide bank 
documents in a terrorist-financing trial, and the multiple links to suspect banks and 
accountholders - present an unusual array of troubling allegations about a particular 
financial institution. When asked about these matters, Al Rajhi Bank has repeatedly 

1 1 87 

condemned terrorism and denied any role in financing extremists. In addition, despite 
all the allegations, neither the bank nor its owners have ever been charged in any country 
with financing terrorism or providing material support to terrorists. 

HSBC was fully aware of the suspicions that Al Rajhi Bank and its owners were 
associated with terrorist financing, describing many of the alleged links in the Al Rajhi 
Bank client profile. 1188 On one occasion in 2008, the head of HSBC Global Banknotes 
Department told a colleague: "In case you don't know, no other banknotes counterparty 
has received so much attention in the last 8 years than Alrajhi." 1189 Despite, in the words 
of the KYC client profile, a "multitude" of allegations, HSBC chose to provide Al Rajhi 
bank with banking services on a global basis. 



D. HSBC Relationship with Al Rajhi Bank 



In the United States, Al Rajhi Bank first became a client of Republic Bank of 
New York during the 1970s; after Republic Bank of New York was purchased by HSBC, 
Al Rajhi Bank became a client of HSBC Bank United States (HBUS). 1190 HSBC also 
had longstanding relationships with Al Rajhi Bank and other Al Rajhi-related businesses 
in other parts of the world, including the Middle East, Europe, and the Far East, which 
HSBC had developed separately from the relationship it assumed from Republic Bank of 
New York in the United States. 1191 HSBC provided Al Rajhi Bank with a wide range of 
banking services, including wire transfers, foreign exchange, trade financing, and asset 
management services. 1192 In addition, in 1998, HSBC Group established "HSBC 
Amanah," a "global Islamic financial services division" designed to "serve the particular 
needs of Muslim communities" in compliance with Islamic law, and provided those 
banking services to Al Rajhi Bank and other Al Rajhi-related businesses. 1193 

In the United States, a key service was supplying Al Rajhi Bank with large 
amounts of physical U.S. dollars, through the HBUS U.S. Banknotes Department. The 
physical delivery of U.S. dollars to Al Rajhi Bank was carried out primarily through the 
London branch of HBUS, often referred to internally as "London Banknotes." HBUS 
records indicate that the London Banknotes office had been supplying U.S. dollars to Al 



See, e.g., "Al Rajhi Bank's Statement on Journal's Article," Wall Street Journal , Abdullah Sulaiman Al Rajhi 
(10/19/2004), http://online.wsi.com/article/SB109813521879148492.html ; "Al Rajhi Bank responds to Wall Street 
Journal report," distributed by PR Newswire, (10/24/2003), 

http://www.thefreelibrary.com/ Al+Rajhi+Bank+responds+to+Wall+Street+Journal+report.-a0109218136. 

1188 See, e.g., 2010 HBUS KYC Profile of Al Rajhi Bank at 6, 11. 

1189 5/2008 email from Christopher Lok to Gary C H Yeung, , "KYC Approval needed for: AL RAJHI BANKING 
& INVESTMENT CORP," OCC-PSI-00 1 55690. 

1190 See 2010 HBUS KYC Profile of Al Rajhi Bank at 4. 

1191 2010 HBUS KYC Profile of Al Rajhi Bank at 4. 

1192 See, e.g., 2010 KYC Profile of Al Rajhi Bank at 8; 5/23/2005 document prepared by CIBM-Institutional 
Banking on Al Rajhi Banking and Investment Corporation, at HSBC OCC 0659988-997, at 8. 

1193 See HSBC website, "About HSBC Amanah," http://www.hsbcamanah.com/amanah/about-amanah. 
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Rajhi Bank for "25+ years." 1194 In addition to the London branch, HBUS headquarters in 
New York opened a banknotes account for Al Rajhi Bank in January 2001. 1195 The U.S. 
dollars were physically delivered to Al Rajhi Bank in Saudi Arabia. 1196 

In January 2005, a little more than three years after the 9/11 terrorist attack on the 
United States, HBUS decided to end its relationship with Al Rajhi Bank due to terrorist 
financing concerns, as explained further below. 1197 Nearly two years later, in December 
2006, the relationship was reactivated and continued for another four years, until 2010, 
when it was ended once more due to a group-wide decision by HSBC to exit the U.S. 
banknotes business. HBUS closed its banknotes account with Al Rajhi Bank in October 
2010. 1198 

From 2000 to 2010, HSBC assigned a series of Global Relationship Managers to 
the Al Rajhi Bank account. They include Shariq Siddiqi 1 199 and Shamzani Bin Md 
Hus sain. 1200 In 2005, the Relationship Manager for KYC approval purposes was Beth 
Fisher. From 2005 to 2010, the head of the HSBC Global Banknotes business was 
Christopher Lok, who was based in New York; the regional Banknotes head for the 
Americas was Gyanen Kumar, who was based in New York; and the regional Banknotes 
head in charge of the London Banknotes office was Stephen Allen. 1201 

HSBC classified Al Rajhi Bank as a "Special Category of Client" (SCC), its 
highest risk designation. 1202 This designation was due in part to the bank's location in 
Saudi Arabia, which HSBC classified as a high risk country. In addition, HSBC noted 
that the bank was owned in part by a Politically Exposed Person (PEP), Abdullah Abdul 
Al Rajhi, who was a major shareholder, a member of the bank's board of directors, and a 
member of the Northern Borders Provincial Council in Saudi Arabia. Al Rajhi Bank 
was one of only a handful of bank clients that HSBC had classified as SCC clients. 1204 



1194 2010 HBUS KYC Profile of Al Rajhi Bank at 3, 5. The London Banknotes office supplied U.S. dollars to both 
Al Rajhi Bank and, until its account closed in 2005, Al Rajhi Trading Establishment. Another HBUS branch office 
in Hong Kong also did banknotes business with Al Rajhi Bank beginning in 2009 . See HBUS "Know Your 
Customer Profile - Banknote Information," for the Hong Kong office regarding Al Rajhi Bank (10/29/2010), 
HSBC-PSI-PROD-0 102782-784, at 1. 

1195 2010 HBUS KYC Profile of Al Rajhi Bank at 2, 3. 

1196 2010 HBUS KYC Profile of Al Rajhi Bank at 2. 

1197 2010 HBUS KYC Profile of Al Rajhi Bank at 2. 

1198 2010 HBUS KYC Profile of Al Rajhi Bank at 1, 15. 

1199 5/23/2005 document prepared by CIBM-Institutional Banking on Al Rajhi Banking and Investment Corporation, 
HSBC OCC 0659988-997, at 7. , 

1200 2010 HBUS KYC Profile of Al Rajhi Bank at 4. 

1201 1 1/2006 HBUS "Banknotes Trading A Global Reach Organizational Chart As of November 2006," OCC-PSI- 
00000501 at 5. 

1202 2010 HBUS KYC Profile of Al Rajhi Bank at 1. 

1203 Id. at 1,3. 

1204 Id. at 3. 

1205 March 2002 email chain among HBUS personnel, "Al Rajhi Trading establishment," OCC-PSI-00381727, at 3. 
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E. Al Rajhi Trading Establishment 

In addition to Al Rajhi Bank, HSBC provided accounts to Al Rajhi Trading 
Establishment, a money exchange business based in Saudi Arabia and owned by Rajhi 
family members. This account closed in 2005, when the business, along with seven 
others, merged into a new bank, Al Bilad Bank in Saudi Arabia. 

According to HSBC internal documents, Al Rajhi Trading Establishment opened 
two accounts in 1994, with Republic Bank of New York before its purchase by 
HSBC. 1205 One account processed payments, such as from travelers cheques or money 
orders, while the other handled foreign currency exchange. According to HSBC 
documents, Republic Bank of New York had a policy of not dealing with money 
exchange businesses, but had made an exception for Al Rajhi Trading Establishment due 
a "long relationship with the bank, their knowledge of the stiff penalties (death) for drug 
trafficking and money laundering within the country and the general good reputation of 
exchange houses in Saudi Arabia." 1206 After HSBC purchased Republic Bank of New 
York, the Al Rajhi Trading Establishment accounts were handled by the HSBC 
International Private Banking Department. 1207 

In 2002, after the 9-11 attack on the United States, the International Private 
Banking Department asked to transfer the two accounts to HSBC's Institutional Banking 
Department in Delaware which had superior ability to monitor account activity. In 
connection with the transfer, HBUS banker Joseph Harpster wrote: 

"The most recent concern arose when three wire transfers for small amounts 
($50k, $3k and $1.5k) were transferred through the account for names that closely 
resembled names, not exact matches, of the terrorists involved in the 9/1 1 World 
Trade Center attack. . . . The profile of the main account reflects a doubling of 
wire transfer volume since 9/01, a large number of travelers checks but with 
relatively low value and some check/cash deposits. According to the account 
officer, traffic increased because they have chosen to send us more business due 
to their relationship with Saudi British Bank 1209 and the added strength of HBC 
versus Republic. . . . Maintaining our business with this name is strongly 
supported by David Hodghinson of [Saudi British Bank] and Andre Dixon, 
Deputy Chairman of [HSBC Bank Middle East]. Niall Booker and Alba Khoury 
[of HBUS] also support." 1210 

Douglas Stolberg head of Commercial and Institutional Banking (CIB) at HBUS 
forwarded the email to Alexander Flockhart, then a senior executive in Retail and 
Commercial Banking at HBUS, noting: "As we discussed previously, Compliance has 



um March 2002 email chain among HBUS personnel, "Al Rajhi Trading establishment," OCC-PSI-00381727, at 3. 

1206 Id. 

1207 Id. 

1208 Id. 

1209 HSBC owned Saudi British Bank. See "Doing Business in Saudi Arabia," an HSBC publication, 
http://www.hsbc.eom/l/content/assets/business_banking/1100511_hsbc_doing_business_in_saudi.pdf. 

1210 March 2002 email chain among HBUS personnel, "Al Rajhi Trading establishment," OCC-PSI-00381727, at 3. 
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raised some concerns regarding the ongoing maintenance of operating/clearing accounts 
for Al Rajhi group." He forwarded recommendations on how to handle the account: 
"Retain [International Private Banking] as the relationship manager domicile for 
continuity purposes, and as we understand there is interest in further developing private 
banking business with family members. . . . Domicile the actual accounts with Delaware 
where HBUS's most robust account screening capabilities reside." His email also stated: 

"[T]his has become a fairly high profile situation. Compliance's concerns relate 
to the possibility that Al Rajhi' s account may have been used by terrorists. If 
true, this could potentially open HBUS up to public scrutiny and /or regulatory 
criticism. SABB [Saudi British Bank] are understandably keen to maintain the 
relationships. As this matter concerns primarily reputational and compliance 
risks, we felt it appropriate for SMC [Senior Management Committee] members 
to be briefed ... so that they may opine on the acceptability of the plan. Please 

1211 

advise how you would prefer us to proceed." 

Mr. Harpster reported a week later that Mr. Flockhart had decided to transfer the accounts 
to HBUS in the Delaware office. 

Three years later, in 2005, eight Saudi money exchangers, including Al Rajhi 

1212 

Trading Establishment, were merged into a new Al Bilad Bank in Saudi Arabia. The 
HSBC accounts for Al Rahji Trading Establishment closed in November 2005. 

F. 2005 Decision to Sever Ties with Al Rajhi Bank 

In 2005, despite its longstanding relationship with Al Rajhi Bank, HSBC Group 
Compliance decided that its U.S. -based businesses should sever ties with Al Rajhi Bank 
due to terrorist financing concerns. 1214 To carry out this decision, on January 28, 2005, 
Teresa Pesce, head of HBUS AML Compliance, sent an email to HBUS personnel 
entitled, "Al Rahji Trading/Al Rahji Banking": 

"As some of you may know, the above named clients have been under 
evaluation by US and Group Compliance based, among other things, on 
relationships maintained with entities/countries on the OFAC list. 
Additionally, US law enforcement has placed these entities under scrutiny. 
After much consideration, Group Compliance has recommended that the 
US businesses sever ties with these clients based on the current regulatory 
environment and the interest of US law enforcement. Accordingly, I will 



1211 Id. at 2-3. 

1212 See April 2005 HBUS Financial Intelligence Group (FIG) Report of Findings (Update) on Al Rajhi Trading 
Establishment, HSBC OCC 2725168-169. Another Al Rajhi-related business, the Al Rajhi Commercial Foreign 
Exchange, was also one of the eight businesses that merged into Al Bilad Bank. See 7/13/2005 HBUS Financial 
Intelligence Group (FIG) Report of Findings (Update) on Al Rajhi Commercial Foreign Exchange, HSBC OCC 
2725167-168. 

1213 4/22/12 HSBC legal counsel response to Subcommittee inquiry. 

1214 2010 HBUS KYC Profile of Al Rajhi Bank at 2 ("relationship exited and deactivated on 2 February 2005 due to 
TF issues"). 
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not approve customer profiles for or transactions with these entities. 
Please make appropriate arrangements. I am available to answer any 
questions you might have." 1215 

At the time the email was issued, Al Rajhi Bank had not been indicted, designated 
as a terrorist financier, or sanctioned by any country, including the United States. HSBC 
Group Compliance based its decision on concerns that the bank had relationships "with 
entities/countries on the OFAC list," the bank was of "interest" to U.S. law enforcement 
which had placed it "under scrutiny," and severing the relationship was called for in light 
of the "current regulatory environment." 1216 

The 2005 decision was made several years after the 9-11 terrorist attack, as U.S. 
law enforcement and bank regulators directed increasing scrutiny to terrorist financing 
issues. As discussed earlier, in 2004, the 9-11 Commission issued its report which 
included information on the role of Saudi Arabia in financing terrorism, described the 
"Golden Chain" of al Qaeda's financial benefactors, and noted that one of the hijackers 
had an account at Al Rajhi Bank. Congress held hearings on that report. The media also 
disclosed in 2004, that Al Rajhi Bank's most senior official was on the Golden Chain 

1217 

list. In addition, 2004 saw the United States designate as terrorist organizations 
several Saudi-based nonprofit organizations that were also clients of Al Rajhi Bank, 
including the International Islamic Relief Organization and the al Haramain Foundation, 
adding them to the OFAC list of entities with which U.S. persons were prohibited from 

1218 

doing business. U.S. prosecutors also intensified their investigation of al Haramain 
Foundation Inc., whose 2005 indictment would disclose that its senior officials had 
cashed $130,000 in U.S. travelers checks at Al Rajhi Bank in Saudi Arabia and used the 
money to support violent extremists in Chechnya. 1219 

On the regulatory front, in July 2004, this Subcommittee held hearings on how U.S. 
banks and U.S. bank regulators had failed to fully implement the tougher AML requirements 

1 990 

enacted into law as part of the USA Patriot Act of 2001, highlighting Riggs Bank as an 

122 1 

example. Among other measures, the Patriot Act required U.S. financial institutions to 
establish AML programs, conduct special due diligence on correspondent accounts opened for 



1213 1/28/2005 email from HBUS Teresa Pesce to numerous HSBC colleagues, "Al Ra[jh]I Trading/Al Ra[jh]I 
Banking," HSBC OCC 1884218. 

1216 When asked about this decision, David Bagley, the head of HSBC Group Compliance, told the 
Subcommittee that there was no single incident that led to the decision. Subcommittee interview of David 
Bagley (5/10/2012). 

1217 See, e.g., "Tangled Paths: A Sprawling Probe Of Terror Funding Centers in Virginia," Wall Street Journal , 
Glenn Simpson (6/21/2004). 

1218 "Blocking Property and Prohibiting Transactions With Persons Who Commit, Threaten To Commit, or Support 
Terrorism," 66 FR 49079 (9/23/2001) (see Annex). 

1219 The U.S. Treasury Department was later quoted as saying Al Rajhi Bank maintained at least 24 accounts and 
handled unusual transactions for the al Haramain Foundation. "US Tracks Saudi Bank Favored by Extremists," 
Wall Street Journal , Glenn Simpson (7/26/2007), http://online.wsj.com/article/SB118530038250476405.html. 

1220 See Title III of the Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept 
and Obstruct Terrorism (USA Patriot Act) Act of 2001, P.L. 107-56 (10/26/2001). 

1221 "Money Laundering and Foreign Corruption: Enforcement and Effectiveness of the Patriot Act, Case Study 
Involving Riggs Bank," S.Hrg. 108-633 (July 15 2004). 
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foreign banks, and verify the identity of accountholders. The law also deemed money 
laundering through foreign banks and the laundering of terrorism proceeds as criminal offenses 
in the United States. 1223 These new provisions had given rise to new bank regulations, new 
examination requirements, and a new emphasis on the importance of AML controls. 

HBUS' primary U.S. regulator, the OCC, scheduled an AML examination of the HBUS 

1224 

banknotes business to take place in 2005. In December 2004, in anticipation of that 
examination, the HBUS Global Banknotes Department had completed a review of its Know 
Your Customer (KYC) client profiles. 1225 In October 2004, the HSBC Global Relationship 
Manager for Al Rajhi Bank, Shariq Siddiqi, visited the bank and reviewed its KYC/AML 
procedures in detail. 1226 Mr. Siddiqi praised the procedures and noted: "The management 
appeared fully cognizant of the reputational risks associated with terrorism financing, and 

1997 

confirmed Al Rajhi Bank's strong commitment to combat it." 

Despite that endorsement of the bank's AML policies and procedures, HBUS AML 
Compliance did not approve the Al Rajhi Bank KYC profile, an action it took with respect to 

I 990 

only a few clients out of more than 930 active client profiles reviewed. The failure to 
approve the client profile meant that bank personnel were unable to do business with the client. 
HBUS AML Compliance Officer Alan Ketley circulated instructions on how to handle clients, 
including Al Rajhi Bank and Al Rajhi Trading Establishment, whose profiles had been "denied" 
by HBUS Compliance. He explained that such clients must be given "10 days notice of trading 
termination unless a dispensation is obtained from the AML Director and an updated profile is 
approved by the AML Director within that 10 day period. For current customers that 10 day 
clock will commence on December 7 (so December 17 will be the final day we will transact with 

1229 

them unless a dispensation is obtained.)" 

On January 4, 2005, HBUS AML Compliance head Ms. Pesce sent an email to Daniel 
Jack, an HBUS AML Compliance Officer who often dealt with the London Banknotes office, 
instructing him to: "[p]lease communicate that Group Compliance will be recommending 



1222 See USA Patriot Act, §§ 312, 326, 352. 

1223 See USA Patriot Act, §§ 318, 376, 377. 

1224 See 3/8/2005 email from Daniel Jack, HBUS, to Denise Reilly and Alan Ketley in HBUS, "Re: KYC 
Deactivation Report for Banknotes in Feb-05," OCC-PSI-00 169771 ("There has been a surge in KYC updates in the 
past few months due to clean-up/prep for OCC."); 6/20/2005 OCC Supervisory Letter on Global Banknote AML 
examination, OCC-PSI-00107505-510 (containing six Matters Requiring Attention by the bank related to AML 
deficiencies) [sealed exhibit]. 

1225 See 1/4/2005 email from Daniel Jack, HBUS Legal Compliance, to HBUS KYC Account Managers, HBUS 
KYC Banknote Traders, and others, "KYC Status of Profiles for Banknotes by Office: December 2004," HSBC 
OCC 2405588-589. 

122 5/23/2005 document prepared by CIBM-Institutional Banking on Al Rajhi Banking and Investment Corporation, 
HSBC OCC 0659988-997, at 3. 

1227 Id. at HSBC OCC 0659991. 

1228 1/4/2005 email from Daniel Jack, HBUS Legal Compliance, to HBUS KYC Account Managers, HBUS KYC 
Banknote Traders, and others, "KYC Status of Profiles for Banknotes by Office: December 2004," at HSBC OCC 
2405588-589. See also 3/7/2005 email from Daniel Jack to Alan Ketley and others, "Re: KYC Deactivation Report 
for Banknotes in Feb-05," OCC-PSI-00 169771 (noting that Al Rajhi Bank was one of only two client profiles 
"deactivated for AML/KYC/Compliance Reasons"). 

1229 12/6/004 email from HBUS Alan Ketley to HSBC Christopher Lok, HBUS Stephen Allen, and others, "KYC 
Profiles - Impact of CO Denial," HSBC OCC 3185023-025. 
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terminating the Al Rahji relationship." Mr. Jack inquired as to when that recommendation 
would be made. She responded: 

"I expect to see an email from Susan Wright today. She tells me that HBME 
[HSBC Bank Middle East] does not agree with Compliance and will not be 
terminating the relationship from the Middle East, but she/David B[agley] 
recommend that in light of US scrutiny, climate, and interest by law enforcement, 

1 9^ 1 

we in the US sever the relationship from here." 

Susan Wright was then the Chief Money Laundering Control Officer for the entire HSBC 
Group. She reported to David Bagley, head of the HSBC Group's overall Compliance 
Department. The documents do not explain why HSBC Middle East disagreed with the 
decision or why it was allowed to continue its relationship with Al Rajhi Bank, when 
HSBC's Group Compliance had decided to sever the relationship between the bank and 
other HSBC affiliates due to terrorist financing concerns. 

The decision to sever ties with Al Rajhi Bank was announced internally within HSBC on 
January 28, 2005. The decision clearly affected some HSBC affiliates, such as HBUS and its 
London Banknotes office which discontinued transactions with Al Rajhi Bank, but not others, 
such as HSBC Bank Middle East which continued doing business with Al Rajhi Bank and other 

1 9^9 

Al Rajhi entities. The Subcommittee asked but has received no explanation as to why the 
decision bound HSBC affiliates in the United States and Europe, but appeared to not apply to the 
Middle East. 

Soon after the decision was announced in January 2005, HSBC Group Compliance began 
to narrow its scope. On February 22, 2005, Paul Plesser, head of the HBUS Global Foreign 
Exchange Department, sent an email to a colleague asking whether, despite the HSBC Group 
Compliance decision, his office could continue to engage in foreign exchange trades with Al 

1233 

Rajhi Trading Establishment. He was told by a trader from the Banknotes department: "For 
us is business as usual." 1234 Mr. Plesser double-checked with HBUS AML Compliance officer 
Alan Ketley, asking in an email: "so I guess we are ok to continue trading?" On March 16, 
2005, Mr. Ketley affirmed that the trades could continue, forwarding an email from Ms. Pesce, 



1/4/2005 email from Teresa Pesce to Daniel Jack, "KYC Status of Profiles for Banknotes by Office: December 
2004," HSBC OCC 2405588. 

1231 Id. 

1232 See, e.g., 1/4/2005 email from Teresa Pesce to Daniel Jack, "KYC Status of Profiles for Banknotes by Office: 
December 2004," HSBC OCC 2405588. See also, e.g., 1 1/17/2006 email from Salman Hussain to David Illing, 
Gordon Brown, Stephen Allen and others, "Al Rajhi Bank KYC & AML Policy," HSBC OCC 3280496-497; 

1 1/17/2006 email from HBUS Stephen Allen to HBUS Beth Fisher and Alan Ketley, "Al Rajhi Banking," HSBC 
OCC 3280505 (both emails indicating that, in late 2006, HSBC business with Al Rajhi Bank was "substantial," 
including through the "HSBC Amanah business"). 

1233 2/22/2005 email from Paul Plesser to Georges Atallah, "Al Ra[jh]i Trading/Al Ra[jh]i Banking," HSBC OCC 
3111888. 

1234 2/22/2005 email from Georges Atallah to Paul Plesser and others, "Al Ra[jh]i Trading/Al Ra[jh]i Banking," 
HSBC OCC 3111888. 

1235 2/22/2005 email from Paul Plesser to Alan Ketley, "Al Ra[jh]i Trading/Al Ra|jh]i Banking," HSBC OCC 
3111888. 
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head of HBUS AML Compliance, stating that the earlier HSBC Group decision no longer 
applied to Al Raj hi Trading: 

"Group has clarified the Al Ra[jh]i guidance issued last month. They have evaluated Al 
Ra[jh]i Banking and Al Ra[jh]i Trading and now believe that the two are separated 
enough that relationships may be maintained with the latter but not with the former. To 
be clear, recommendation is to sever with Banking only at this time." 

Mr. Ketley commented: "Looks like you're fine to continue dealing with Al Rajhi. You'd better 

1937 

be making lots of money!" 

In May 2005, four months after announcing the decision to sever ties with Al Rajhi Bank, 
HSBC Group Compliance backed down still further. It announced that HSBC affiliates could re- 
establish business ties with Al Rajhi Bank, though subtly suggested that HBUS might not. David 
Bagley, head of HSBC Group Compliance, announced the decision in a May 23 email sent to 
HSBC personnel: 

"Having now received the updated KYC from Shariq Siddiqi and 
reviewed the previous information received from Group Securities I am 
pleased to confirm that we have revised our recommendation in relation to 
the above. 



Accordingly we have lifted our recommendation against the commence or 
expansion of relationships with the above with immediate effect. We 
will communicate this decision to HBEU [HSBC Europe] where I believe 
there are a number of pending applications. 

Whilst we will advise HBUS CMP [Compliance] of the revised view 
within GHQ CMP [Group Headquarters Compliance] nevertheless I 
believe it will remain appropriate for HBUS CMP in conjunction with 
HBUS senior management to reach their own determination with regard to 
the expansion of business with Al Rajhi within the US. Although the 
revised view from GHQ CMP ought to be a material matter causing them 
to reconsider their position nonetheless, and particularly in the current US 
environment, I do not believe it is appropriate for us to seek to influence 
their determination one way or the other." 1239 



Ulb 3/16/2005 email from Alan Ketley to Paul Plesser, "Fw: Al Ra[jh]I Guidance Clarified," HSBC OCC 31 14022. 

1237 Id. 

1238 The new decision lifted the ban on relationships with both Al Rajhi Bank and Al Rajhi Commercial Foreign 
Exchange, another money exchange business owned by Abdullah Abdul Al Rajhi. The decision on Al Rahhi 
Commercial Foreign Exchange was in addition to the earlier decision allowing relationships with Al Rajhi Trading 
Establishment. 

1239 5/23/2005 email from HSBC David Bagley to HSBC colleagues, "Al Rajhi Bank," OCC-PSI-00144350 at 2. 
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The effect of this decision was to allow HSBC affiliates to do business with Al Rajhi 
Bank if they chose, which meant HBUS Compliance had to determine for itself whether 
or not to re-establish ties with Al Rajhi. 1240 

G. 2006: HBUS Banknotes Account Reinstated 

Although HBUS Compliance in the United States held out almost two years, after 
a concerted campaign by HBUS Banknotes personnel, it ended up following the lead of 
HSBC Group Compliance and restoring the Al Rajhi Bank account at HBUS in late 2006. 
One precipitating event appears to have occurred in November 2006, when Al Rajhi 
Bank threatened to pull all business from HSBC, unless the U.S. banknotes services were 
restored. Within a month, the account was reestablished. 

The two HBUS bankers who spearheaded the effort to restore the Al Rajhi 
account were Christopher Lok, head of the HSBC Global Banknotes Department, 
working from New York, and Stephen Allen, head of the HBUS Banknotes branch in 
London. For more than 20 years, the London office had supplied physical U.S. dollars to 
Al Rajhi Bank in Saudi Arabia, until forced to stop by the January 2005 decision. 

When HSBC Group Compliance reversed the decision on Al Rajhi Bank for 
HSBC affiliates on May 23, 2005, HSBC Banknotes personnel expressed a desire to 
reopen their accounts with Al Rajhi Bank as well, while signaling a willingness to wait 
until the conclusion of an upcoming Global Banknotes examination by the OCC. 1241 On 
May 23, 2005, Mr. Allen, head of the London Banknotes office, forwarded the HSBC 
Group Compliance email regarding Al Rajhi Bank to Mr. Lok, head of the Global 
Banknotes Department, stating: "We'll have to see if this will make any difference!" 1242 
Mr. Lok, in turn, sent an email to Ms. Pesce, head of HBUS AML Compliance, stating: 
"After the OCC close out and that chapter hopefully finished, could we re-visit Al Rajhi 
again. London compliance has taken a more lenient view." 1243 

The on-site work for the OCC AML examination concluded about a month 
later, 1244 and the HBUS London branch shortly thereafter began to discuss plans to speak 
with HBUS AML Compliance to allow it to resume ties with Al Rajhi Bank. In a July 
2005 meeting to discuss KYC issues, members of the HBUS London Banknotes office 
discussed both the results of the OCC examination and next steps to discuss the future of 
HSBC's relationship with Al Rajhi Bank: 



At almost the same time, HSBC CIMB -Institutional Banking, which is part of HSBC Amanah, approved 
additional banking services for Al Rahji Bank, including trade, treasury, SWIFT wire transfers, foreign exchange, 
and asset management services. See 5/23/2005 document prepared by CIBM-Institutional Banking on Al Rajhi 
Banking and Investment Corporation, HSBC OCC 0659988-997, at 8. 

1241 See 5/15/2006 OCC letter to HBUS ("On June 12, 2006 we will begin a 3-week Examination of Global 
Banknotes, London. We hope to complete on site work on or before June 30, 2006."). 

1242 5/23/2005 email from HBUS Stephen Allen to HSBC Christopher Lok, "Al Rajhi," OCC-PSI-00144350 at 1-2. 

1243 5/23/2005 email from HSBC Christopher Lok to HBUS Teresa Pesce, "Al Rajhi," OCC-PSI-00144350 at 1. 

1244 6/20/2005 OCC Supervisory Letter, Global Banknote examination of HSBC, USA, OCC-PSI-00 107505. 
[Sealed Exhibit.] 
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"DJ [Daniel Jack]: We gave the OCC 108 client files. The primary focus 
of their finding[s] boiled down to 18 files concentrating on the money 
service business[es] and high risk clients. We obtained a satisfactory 
rating from the OCC although their examiners identified 5 issues 
considered 'Matters Requiring Attention' with urgency. 1245 . . . 

Saudi: We lost Al Rajhi this year - we discussed this in various 
compliance meetings already. SA [Stephen Allen] - a resumption 
decision was put off because of the OCC audit. CL [Christopher Lok] to 
speak to SA after the OCC. Allen to speak to Terry [Pesce] before his 
holidays. Al Rajhi threatened to pull any new business with HSBC, unless 
we give them a satisfactory reason why we won't trade banknotes with 



Al Rajhi Bank communicated the threat to "pull any new business with HSBC" unless 
given a "satisfactory explanation" why HSBC had stopped supplying it with U.S. dollars 
via its relationship managers. 1247 That threat was not mentioned again in the documents 
provided to the Subcommittee. 

The next month, in August 2005, Mr. Allen sent Sally Lomas, KYC manager for 
the London Banknotes office, a copy of the Lok email asking HBUS AML Compliance 
to re-visit the Al Rajhi issue, together with the HSBC Group Compliance email allowing 
re-establishment of the relationship for the rest of HSBC. Ms. Lomas forwarded the 
emails to Lynda Cassell, then head of General Compliance at HBUS. Ms. Lomas wrote: 

"Please find attached an email sent by David Bagley, indicating that there is no 
longer a recommendation against expanding relationships with Al Rajhi Bank. I 
have asked Fig [HSBC Financial Intelligence Group] to check, when they do their 
additional work, whether the same part of the Al Rajhi fa[m]ily is in[vol]ved in 
both Banks." 1248 

On the same day, Ms. Pesce, head of HBUS AML Compliance, responded to the Lomas 
email, warning that re-opening the Al Rajhi Bank account should not be viewed as an 
easy decision: 

"This is not so simple. David [Bagley] does not object insofar as HBEU [HSBC 
Europe] is concerned, but has left it to us to assess the US risk. We've gotten 
push back from the OCC on Al Rahji Trading, which is less controversial than the 



The MRAs cited by the OCC required the London Banknotes Office to conduct a client file review to improve 
client information and analysis; review client risk ratings; add expected client account activity to the client files; 
revise written procedures to include the need to obtain expected client activity; and improve AML training in these 
areas. Id. 

1246 7/12/2005 "HBUS London Banknotes Minutes of KYC Review Meeting," OCC-PSI-00835857, , at 1, 4 
(emphasis in original). 

1247 Subcommittee interview of Christopher Lok (3/29/2012) and Alan Ketley (2/16/2012). 

1248 8/10/2005 email from Sally Lomas to Lynda Cassell with copies to Teresa Pesce, Alan Ketley, Stephen Allen, 
and others, "Al Rajhi," OCC-PSI-00343527. 
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bank. We can revisit this, but I am not inclined to push ahead precipitously, 
especially in light of the regulatory scrutiny." 1249 

In January 2006, the Banknotes Department tried again. Minutes of a London 
Banknotes meeting to discuss KYC issues recorded the following discussion: 

"Banknotes-London would like to resume business with Al Rajhi, although we 
have ceased trading (due to rumours in terrorist financing, the U.S. Government 
has now dropped those charges . ..)[.] [T]he rest of the HSBC group still deal with 
them. LC [Lynda Cassell] advised a conference call with Terry [Pesce] is needed 
but before this takes place LC would like to see a memo from SA [Stephen Allen] 
about the history of this matter, subsequently Lynda will take this memo to Terry 
to arrange the conference call." 1250 

The minutes reflect that a rumor was circulating among several HSBC officials that the 
U.S. government had "dropped" charges of terrorist financing against the bank, which 
was not the case since no formal charges had ever been filed. The minutes also indicate 
that all HSBC affiliates were then allowed to do business with Al Rajhi Bank other than 
HBUS, a fact used at one point to try to convince HBUS Compliance to allow the 
account. 

In February 2006, Mr. Allen met with Lynda Cassell, Senior AML Policy 
Advisor, about Al Rajhi Bank. That same month, Gordon Brown, who had taken over 
London Banknotes KYC issues from Susan Lomas, provided Ms. Cassell with a copy of 
Al Rajhi Bank's AML policies and procedures. 1252 Ms. Cassell responded with an email 
to Mr. Brown, Mr. Allen, and others explaining: 

"Gordon, in accordance to our previous conversation, the AML compliance 
decision to do business with Al Rajhi lies with Terry Pesce and as suggested, 
Stephen [Allen] should speak to Terry regarding his desire to enter into a 
Banknotes relationship. ... In regards to Al Rajhi' s AML Policy and Procedures, I 
find them comprehensive .... Their high risk client base generally mirrors our 
high risk type clients." 

In March 2006, Mr. Allen and Mr. Brown exchanged emails with Mr. Ketley, a 
senior HBUS AML Compliance officer who worked for Ms. Pesce. 1254 Mr. Allen wrote: 

"[According to Al Rajhi, their senior management had been advised by the US 
State Department that they were no longer considered to be under suspicion and I 



124y 8/10/2005 email from Teresa Pesce to Sally Lomas and others, "Al Rajhi," OCC-PSI-00343527. 

1250 1/26/2006 "HBUS London Banknotes Minutes of KYC Review Meeting," OCC-PSI-00835851, at 3. 

1251 See 3/21/2006 email from HSBC Stephen Allen to HBUS Alan Ketley and Gordon Brown, "AL Ra[jh]L" HSBC 
OCC 0695040. 

1252 2/6/2006 email from HSBC Gordon Brown to HBUS Lynda Cassell, "AML Procedures: AlRajhi Banking & 
Investment Corp., Saudi Arabia," HSBC OCC 3250665-667, at 667. 

1253 2/8/2006 email from HBUS Lynda Cassell to HSBC Gordon Brown and others, "AML Procedures: AlRajhi 
Banking & Investment Corp., Saudi Arabia," HSBC OCC 3250665-667, at 666. 

1254 3/20/2006 email exchange between HBUS Alan Ketley and HSBC Stephen Allen and Gordon Brown, "AL 
Ra[jh]I," HSBC OCC 0695040. 
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was wondering whether HBUS Compliance or Security may have a contact at 
State . . . that could be explored to verify this statement?" 1255 

Mr. Ketley agreed to try to verify the information, and Mr. Allen responded: 

"Thanks Alan, anything that you can do is appreciated as, with the summer heat 
approaching, this client becomes very active and is commercially extremely 
important to us - if we can ever get to re-start our business with them that is. You 
may recall me telling you that we dealt with Al Rajhi for 30 years prior to being 
obliged to desist!" 1256 

Also in March 2006, Beth Fisher, an HBUS employee who used to be the 
corporate relationship manager assigned to Al Rajhi Bank, discovered that HBUS had 
failed to cancel a $50 million line of credit for the bank when the relationship ended. She 
sent an email to Mr. Ketley: "I thought we exited this name!" He responded: "I 
gather tha[t] Banknotes wants to revive the relationship but has not yet done so." The 
next day, Ms. Fisher explained to a colleague: "FYI, this was an HBUS London 
Banknotes (only) relationship which was exited a year ago due to AML Compliance 
concerns. . . . This is NO LONGER an HBUS relationship. We must remove this bank 
from our list." 1258 



In April 2006, Susan Wright, head of AML Compliance for the entire HSBC 
Group, weighed in, sending an email to Ms. Pesce and Mr. Ketley asking, "what the 
position is with regard to the possibility of a Bank Note relationship in London" with Al 
Rajhi? 1259 Ms. Pesce responded: "It still makes me nervous. Alan has gone out to Steve 
Allen for more KYC/EDD [Know Your Customer/Enhanced Due Diligence]." Mr. 
Ketley told the Subcommittee that the Al Rajhi Bank relationship was the only one where 
he was influenced by HSBC Group. 1260 

That same day, April 10, 2006, Lynda Cassell sent an email to Mr. Allen at 
London Banknotes requesting information about whether Al Rajhi Bank did business in 
countries subject to OFAC sanctions and how they would use U.S. banknotes, if they 
were restored. 1261 He arranged for an inquiry to be sent to Al Rajhi Bank which then 
took five months to respond with limited information. 1262 For example, in response to a 
question asking the bank to "confirm the countries outside of Saudi Arabia that you do 



1255 Id. It is unclear what his email referred to when it said that the State Department told the bank that it was no 
longer "under suspicion." 

1256 3/21/2006 email from HSBC Stephen Allen to HBUS Alan Ketley and Gordon Brown, "AL Ra[jh]I," HSBC 
OCC 0695039. 

1257 3/20/2006 email from HBUS Beth Fisher to HBUS Alan Ketley, "Al Rajhi," HSBC OCC 3224893. 

1258 3/21/2006 email from HBUS Beth Fisher to HBUS Dorothy Gulman, Alan Ketley and others, "Re: Updated 
TSO/TCS2 spreadsheet," HSBC OCC 3225386. 

1259 4/18/2006 email exchange between HSBC Susan Wright and HBUS Teresa Pesce, "Al Rajhi," HSBC OCC 
4827027. 

1260 Subcommittee interview of Alan Ketley (2/16/2012). 

1261 4/10/2006 email from HBUS Lynda Cassell to HBUS Stephen Allen, "AlRajhi Banking & Investment Corp., 
Saudi Arabia," HSBC OCC 3250665. 

1262 9/17/ 2006 email from Al Rajhi Bank Mohd Fazal Haque to HSBC Salman Hussain, "HSBC Bank Middle East 
Limited," HSBC OCC 3280498-499. 
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business with," Al Rajhi Bank wrote: "All our correspondent banks['] names are 
available in the Bankers Almanac." 1263 When asked how the bank ensures it does not 
utilize HBUS products or services in countries that are "OFAC-sanctioned," the bank's 
entire response was: "We apply strict due diligence and KYC procedures to high risk 
countries." 1264 Both replies did not sufficiently answer the questions posed. 

The bank provided a slightly longer answer when asked how it would use U.S. 
banknotes: 

"All USD banknotes we purchase [are] for our own branches['] use. . . . [W]e have 
a big population of around 7 million foreign workers in the kingdom who mostly 
prefer USD when traveling back to their countries on vacation or even when 
remitting money to their families .... Also during summer time we have a high 
demand from tourist[s] traveling for their vacations." 1265 

This response suggested that, if re-supplied with U.S. dollars, the bank would provide 
those dollars to a wide group of persons in Saudi Arabia, many of whom would be 
expected to transport the dollars across international borders into other countries. 

In June 2006, HSBC Bank Middle East added its voice to that at the Banknotes 
group in pushing for the account to be reopened. Salman Hussain, then Payments and 
Cash Management (PCM) Regional Sales Manager for HSBC Bank Middle East, sent an 
email to Mr. Ketley at HBUS AML Compliance highlighting the potential revenue if Al 
Rajhi Bank were to be reinstated as a banknotes customer: 

"I am sending you this email seeking your assistance to address any issues 
pertaining to Al Rajhi Bank in order to obtain compliance approval. ... As I 
understand from talking to all parties that we had an excellent relationship with Al 
Rajhi Bank until year 2004, banknote[s] (David Illing) stopped doing business 
while being the largest revenue generator in the Middle East. Amanah Finance in 
London (Emran Ali Reza) still trade[s] with Al Rajhi Bank .... From my side, I 
would like to use the Islamic Overnight Investment [product] ... as an intra to this 
bank. The amount of potential business/revenue is quite substantial 

Mr. Hussain sent copies of his email to six colleagues in various HSBC departments. 

Mr. Ketley responded to Mr. Hussain on the same day as follows: 

"This must be the week for Al Rajhi as yours is the second e-mail about 
the bank that I have received. 



1263 Id. at HSBC OCC 3280498. 

1264 Id. 

1265 Id. at HSBC OCC 3280499. 

1266 6/22/2006 email from HBME Salman Hussain to HBUS Alan Ketley with copies to others in HSBC, "Al Rajhi 
Banking & Investment Corp. (Al Rajhi Bank), Saudi Arabia," HSBC OCC 3250655. 
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HBUS exited the relationship in 2004 primarily for Compliance reasons. 
Earlier this year, Banknotes London expressed their desire to re-establish 
the relationship and there has been a fair amount of discussion about 
whether or how to do this. . . . 

[C]ertain questions . . . need to be addressed before any Compliance 
decision can be made about resuming the relationship. For your 
information, Banknotes London has been fully embroiled in (preparing for 
and now in the midst of) an OCC exam so are unlikely to have been able 
to pursue these questions. 

The concerns about this name in the US have been rather long standing 
and we will need to get extremely comfortable with Al Raj hi before we 
would be willing to re-establish a relationship." 

In June 2006, the OCC completed the on-site work for its AML examination of 
the London Banknotes Office and, in September, sent a Supervisory Letter to 
HBUS summarizing the results and directing the London office to improve its 
know-your-customer information and client risk ratings. 1268 

Also in June 2006, Emma Lawson, who worked for Susan Wright, head of 
AML Compliance for the HSBC Group, sent an email to Mr. Ketley and Ms. 
Pesce inquiring about progress on the Al Rajhi Bank account. 1269 Mr. Ketley 
responded that they had yet to receive answers to certain AML questions, in part 
because London Banknotes personnel "have been fully engaged on an OCC exam 
for the past few months. The exam will end on June 30 so I expect they will 

1 970 

revisit the subject then." 

In July 2006, the London Banknotes office held a meeting to discuss its 
business activities and prospects, and again brought up Al Rajhi Bank. A 
summary of the meeting stated: 

"Saudi Arabia . . . [W]e are experiencing a lot of competition from Commerz 
[Bank] who are shipping [U.S. dollars] directly from NY [New York] into 
Saudi and they are offering nearly 50% cheaper prices than BN [Banknotes] 
quote, so work has had to be done to offer better prices to re-gain volume in 
this business. We only have two customers here . . . but we continue to press 



126/ 6/22/2006 email from HBUS Alan Ketley to HBME Salman Hussain and others in HSBC, "AlRajhi Banking & 
Investment Corp., Saudi Arabia," HSBC OCC 3250655. 

1268 See 9/26/2006 OCC Supervisory Letter HSBC-2006-29, "London Global Banknote BSA/AML Examination," 
OCC-PSI-00 10755-760. [Sealed Exhibit.] 

1269 6/20/2006 email from HSBC Emma Lawson to HBUS Alan Ketley and Teresa Pesce, "AlRajhiBanking & 
Investment Corp., Saudi Arabia," HSBC OCC 3281773-774. 

1270 6/20/2006 email from HBUS Alan Ketley to HSBC Emma Lawson and Teresa Pesce, "AlRajhiBanking & 
Investment Corp., Saudi Arabia," HSBC OCC 3281773-774. 
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for the re-instatement of Al Ra[jh]I but there remain ongoing KYC 
issues." 1271 

In the fall, at the request of Gordon Brown, KYC manager at the London 
Banknotes office, the HSBC Financial Intelligence Group (FIG) provided an update to an 

1272 

existing investigative report on Al Rajhi Bank. The report was only three pages long 
and consisted primarily of information taken from publicly available publications about 
the bank's ownership and management. The report also noted that a U.S. judge had 
dismissed the bank from a lawsuit brought by victims of the 9/1 1 terrorist attack, and that 
the World-Check database had listed the bank's Chairman and Managing Director 
Sulaiman Abdul Aziz Al Rajhi under its category for "terrorism." 1273 

Following receipt of the report, the KYC customer profile was updated by the 
HBUS Banknotes Department for Al Rajhi Bank with a view toward reinstating the 
account. The profile stated in part: 

"A multitude of allegations have surrounded the Al-Rajhi family implicating them 
in a gamut of highly adverse activities ranging from money laundering to terrorist 
financing. The current facts, however, do not easily support these allegations. 
Presently, no U.S. or foreign government law enforcement or regulatory body has 
stated, unconditionally, that any member of Al-Rajhi or any company controlled 
by Al-Rajhi is under sanction. The U.S. continues to pursue relationship with 
Saudi Arabia and the Al-Rajhi family irregardless of the allegations being levied 
against charitable institutions with some presumably direct and indirect links to 
Al-Rajhi. The major 9/1 1 lawsuit, which included Al-Rahji, has been dropped 
against the family and family-related institutions. 

However, there is some reputational risk and the possibility that further 
investigations by U.S. authorities may ultimately uncover substantiating proof of 
the Al-Rajhi connection to terrorism is certainly a concern. Our account 
relationship with Al-Rajhi will be primarily selling USD banknotes out of 
London. The risk of future sanctions and the reputational risk based on the 
aforementioned allegations should be measured against the current risks involved 
in our relationship when ultimately deciding our course of action. Therefore, 
London Banknotes feels that the bank poses minimal reputational risk to us." 1274 

This justification for renewing the account relationship had two key features. First, it 
asserted that, despite many allegations, no government had stated "unconditionally" that 
Al Rajhi Bank or its owners were under sanction for financing terrorism. Second, it 



1271 7/24/2006 "2Q06 London Banknotes Review Meeting," HBUS London Banknotes branch, HSBC OCC 
2691117-124, at 122 (emphasis in original). 

1272 10/24/2006 email from FIG Michael Ellis to HBUS Gordon Brown and others, "Report of Findings - Al Rajhi 
Banking & Investment Corp. - FIG," HSBC OCC 7519403-406. 

1273 Id. at HSBC OCC 7519405-406. 

1274 2010 HSBC KYC Profile of Al Rajhi Bank at 11-12. HSBC KYC profiles are evolving documents that retain 
past information stretching back multiple years. 
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focused on "current risks" and asserted that, measured against those, Al Rajhi Bank 
posed only "minimal" reputational risk to HSBC. 

On November 14, 2006, Christopher Lok, head of Global Banknotes, submitted 
the new profile for approval to Beth Fisher, the HBUS corporate relationship manager 
formerly assigned to Al Rajhi Bank. Ms. Fisher responded to Mr. Lok, with a copy to 
Mr. Ketley and Mr. Jack in HBUS AML Compliance, "I thought this was an HSBC exit 
name." Mr. Ketley replied to her, "It was exited once (2004?) - Banknotes London is 
looking to reopen the relationship." He also stated: "The profile had better be bullet 
proof." 1277 

Three days later, Mr. Allen sent Ms. Fisher and Mr. Ketley an email urging them 
to expedite their review of the client profile, which he hoped would reestablish the 
account, citing a threat by Al Rajhi Bank to pull all business from HSBC unless the U.S. 
banknotes services were restored: 

"Salman Hussain, the PCM [Payments and Cash Management] Regional Sales 
Manager at HBME [HSBC Bank Middle East] in Bahrain, who has recently visited 
the subject, has called to say that Al Rajhi has now run out of patience waiting for us 
to re-start our banknote trading relationship and unless we can complete the kyc 
formalities and advise them accordingly by the end of November, they will terminate 
all product relationships with the HSBC Group - which I believe to be substantial. 

Their main point of contention is that they feel that they were exonerated by all US 
legal processes from TF [Terrorist Financing] suspicion some time ago and yet we 
have still not been able to re-start trading with them. Gordon [Brown] finished our 
latest attempt at the profit on Tuesday and you will find the kyc profile to be 
currently in the 'IB Pending' inbox. Could I please ask you both to expedite your 
reviews so that we can attempt to prevent the loss of an important client to the 
Group?" 1278 

Later in the day, Mr. Allen forwarded to Ms. Fisher and Mr. Ketley an email that 

1 ?7Q 

had been sent by Mr. Hussain after he met with the bank in Riyadh, Saudi Arabia. 
Mr. Hussain had sent the email to Mr. Allen and other colleagues, informing them that 
Cassim Docrat, an Al Rajhi Bank representative, had told him that if the U.S. banknotes 
business wasn't reestablished by the end of November, Al Rajhi Bank would "cancel any 



12/5 1 1/14/2006 email from HSBC Christopher Lok to HBUS Beth Fisher, "KYC Approval needed for: Al Rajhi 
Banking & Investment Corp," HSBC OCC 3279589-590. 

1276 1 1/14/2006 email from HBUS Beth Fisher to HSBC Christopher Lok and HBUS Alan Ketley, "KYC Approval 
needed for: Al Rajhi Banking & Investment Corp," HSBC OCC 3279589. 

1277 1 1/14/2006 email from HBUS Alan Ketley to HBUS Beth Fisher, "KYC Approval needed for: Al Rajhi 
Banking & Investment Corp," HSBC OCC 3279589. 

1278 1 1/17/2006 email from HBUS Stephen Allen to HBUS Beth Fisher and Alan Ketley, "Al Rajhi Banking," 
HSBC OCC 3280504-505. 

1279 1 1/17/2006 email from Salman Hussain to David Ming, Gordon Brown, Stephen Allen and others, "Al Rajhi 
Bank KYC & AML Policy," HSBC OCC 3280496-497. Mr. Salman was meeting with the bank, because HSBC 
Bank Middle East had never ceased doing business with it. 
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1280 

business dealings with HSBC." His email also stated that the bank had indicated it 
had been able to procure a large line of credit from one of HSBC's competitors, 
JPMorganChase. Mr. Hussain wrote: 

"I can't stress on the fact that we do want to do business with this institution from 
PCM [Payments and Cash Management] side. We do stand a good chance to win a 
US$ clearing account thru offering Islamic Overnight Investment Product and the US 
$ checking clearing thru Check 21." 1281 

Mr. Allen also sent a copy of Mr. Hussain' s email to Mr. Lok, commenting: "As 
ever, we are taking an inordinate amount of time to make our minds up. I discussed this 
client with Terry [Pesce], Linda [Cassell] and Alan [Ketley] when I visited in February, 
we eventually received and have now answered a rate of supplementary questions from 
Linda and now that she has left, no doubt there will be more questions from Alan!" 1282 
Mr. Lok responded: 

"I would tell Salman that he should relay the 'concern' Alrajhi has expressed to the 
higher ups. To cancel the Amanah business is much bigger than not dealing with 
banknotes. Hopefully somebody in London will listen and given NYK [New York] 
Compliance a gentle push." 

That afternoon, Ms. Fisher sent an email to Mr. Allen declining to approve the 
new Al Raj hi Bank client profile: 

"I am not trying to be difficult, but I do not personally feel comfortable [being the] 
IB [institutional banker] approving this name. I do not know this bank. 
Additionally, several years ago, when HBUS had relationships with 2 different Al 
Rajhi names, management would ask me questions about the customer every time the 
name appeared in the US newspapers. I do not know this bank personally and 
therefore not qualified to render an opinion. . . . Therefore, please ask another officer 
to IB approve. I am IB-Denied the KYC, so that my name can be removed as RM 
[relationship manager]." 1284 

Mr. Allen responded: "I quite understand your position and I will try another tack." 

After receiving her refusal to approve the Al Rajhi Bank profile, Mr. Allen 
forwarded it to Mr. Lok and asked: "[W]ho do you suggest can/will sign this profile? 
You will see that it is pressing - perhaps David [Wilens] could IS and you could IB 



1 1/17/2006 email from Salman Hussain to David Ming, Gordon Brown, Stephen Allen and others, "Al Rajhi 
Bank KYC & AML Policy," HSBC OCC 3280496-497. 

1281 Id. 

1282 11/17/2006 exchange between HBUS Stephen Allen to HSBC Christopher Lok, "Alrajhi," OCC-PSI-00 150798. 

1283 Id. 

1284 j 1/1 7/2006 email from HBUS Beth Fisher to HBUS Stephen Allen, Alan Ketley, Christopher Heusler, "Al 
Rajhi Banking," HSBC OCC 3280504. 

1285 1 1/17/2006 email from HBUS Stephen Allen to HBUS Beth Fisher, Alan Ketley, Christopher Heusler, "Al Rajhi 
Banking," HSBC OCC 3280504. 
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approve if Susan [Wright] and I sign it again?" Mr. Lok responded: "At the end of 
the day, its compliance who's the key. I'll speak to Ketley & ask him to re-evaluate this 
name." Mr. Lok also sent an email to Mr. Allen informing him: "Just spoke to Alan 
[Ketley]. He's going to read the whole file . . . and he's aware of the 'threat' you passed 
along. His view is Alrajhi may not really walk away if we can't revert by November end, 
which I agree. . . . W[e] should have an answer in the next few weeks." 1288 

Over the next few days, Mr. Ketley reviewed Al Rajhi Bank's AML policies and 
procedures. He also asked Mr. Hussain: "What revenue projections do you have 
associated with the US$ clearing and Check 21 'cash letter'" services that could be 
provided by HBUS to Al Rajhi Bank? 1289 Mr. Hussain responded: "Estimated revenue 
will be a minimum of $100k per annum." 

Emma Lawson, in AML Compliance at HSBC Group Headquarters, also sent an 
email to Mr. Ketley asking, "Has progress been made." 1290 Mr. Ketley responded: 

"Your timing is uncanny and I suspect not entirely unrelated to correspondence last 
week from Banknotes and PCM. I have reviewed the new documentation provided 
by the client and discussed it with Terry [Pesce] - she has indicated a desire to 
discuss with David. Will keep you posted." 1291 

A later email indicated that Ms. Pesce also raised the matter with "the Bank's executive 

«. ,,1292 

management. 

On December 1, 2006, Mr. Ketley sent an email to Mr. Allen and Salman Hussain, 
with copies to Ms. Pesce and Mr. Lok, indicating he would approve re-opening the 
banknotes account with Al Rajhi Bank: 

"[T]he purpose of this note is to confirm to you the willingness of HBUS to 
recommence a relationship with Al Rajhi Bank. . . . 



1286 1 1/17/2006 email from HBUS Stephen Allen to HSBC Christopher Lok and David Wilens, "Al Rajhi Banking," 
OCC-PSI-00 150795. In a Subcommittee interview, Mr. Lok explained that he retained the authority to act as the 
institutional banker for a client and so could approve a client profile. Subcommittee interview of Christopher Lok 
(3/29/2012). David Wilens was the chief operating officer of the London Banknotes office and later became chief 
operating officer for the entire HBUS Banknotes Department. See Nov. 2006 HBUS organizational chart, OCC- 
PSI-00000501 at 505. 

1287 1 1/17/2006 email from HSBC Christopher Lok to HBUS Stephen Allen and HSBC David Wilens, "Al Rajhi 
Banking," OCC-PSI-00 150795. 

1288 1 1/17/2006 email from HSBC Christopher Lok to HBUS Stephen Allen, "Alrajhi," OCC-PSI-00150796. 

1289 1 1/20/2006 email from HBUS Alan Ketley to HSBC Salman Hussain, with copies to Stephen Allen, Gordon 
Brown, and others, "Re: Fw: Al Rajhi Bank KYC & AML Policy," HSBC OCC 3280945. 

1290 6/20/2006 email exchange between HSBC Emma Lawson and HBUS Alan Ketley, "Fw: AlRajhi Banking & 
Investment Corp., Saudi Arabia," HSBC OCC 3281773-774. 

1291 Id. Teresa Pesce, then HBUS AML head, told the Subcommittee that she didn't recall any specific pressure 
exerted by HSBC Group with regard to the Al Rajhi Bank relationship, but she knew that HSBC Group was 
interested in maintaining it. Subcommittee interview of Teresa Pesce (3/30/12). 

1292 6/3/2008 email from HBUS Denise Reilly to HBUS Alan Williamson, Daniel Jack, Anne Liddy and others, 
"Banknotes with Al Ra|jh]I Banking in S.A.," HSBC OCC 1638575. Ms. Pesce told the Subcommittee that the 
United States initially raised the idea of exiting the Al Rajhi relationship. She said she may have raised it with 
Susan Wright, David Bagley and "the board." Subcommittee interview of Teresa Pesce (3/30/2012). 
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[I] am satisfied that we can do business with this entity as long as our due 
diligence is thoroughly documented and close transaction monitoring takes 
place by Compliance along with a high degree of transaction awareness being 
maintained by the business. Over a period of years there has been much 
negative publicity associated with the principals of this entity - while none of 
these allegations has been proven or substantiated, the notion of 'no smoke 
without fire' is one we must bear in mind and any business unit dealing with 
this entity must acknowledge the associated risks. . . . [T]o paraphrase an 
expression from English Banking, if it is in my hand and in order I will 
approve it." 1293 

Mr. Ketley also placed several conditions on the approval of the client profile, noting that 
his approval extended only to banknotes transactions and not to cash letter transactions. 
He also stated that the bank could engage in wire transfers, but "I cannot support paper 
activity with the degree of close monitoring that would be appropriate." 1294 

Mr. Ketley noted that Christopher Lok, head of Global Banknotes, would act as 
the "relationship owner" of the account in place of Beth Fisher, and would "approve the 
profile if he is satisfied with it." 1295 

Mr. Ketley announced the decision to reopen the Al Rajhi Bank account despite, 
in the words of the 2006 client profile, a "multitude of allegations . . . implementing [Al- 
Rajhi] in a gamut of highly adverse activities ranging from money laundering to terrorist 
financing." The decision was also made despite the refusal of the prior Al Rajhi Bank 
relationship manager, Beth Fisher, to approve the profile, and immediately after HSBC 
learned that the outside KYC database it relied on for due diligence, World Check, had 
identified Al Rajhi Bank's most senior official as linked to terrorism. The decision also 
came one year after a 2005 U.S. indictment provided a concrete example of Al Rajhi 
Bank's alleged link to terrorism, disclosing how senior officials from al-Haramain 
Foundation Inc. had cashed $130,000 in U.S. travelers cheques at Al Rajhi Bank in Saudi 
Arabia and then smuggled the money to violent extremists in Chechnya. 1296 

The 2006 client profile focused on the fact that no country had indicted, issued a 
terrorist-related designation, or sanctioned Al Rajhi Bank or its owners, even though that 
was also true in 2005, when the original decision to close the account was made. The 



1293 12/1/2006 email from HBUS Alan Ketley to HBUS Stephen Allen, HSBC Salman Hussain and others, "Al Rajhi 
Bank," OCC-PSI-00150892. Ms. Pesce told the Subcommittee that the court dismissal of charges against the bank 
was the single most important reason that she decided to re-open the relationship. Both Mr. Ketley and Ms. Pesce 
stated that they did due diligence on Al Rajhi Bank, and both thought that the risk could be managed and that they 
made sure the regulators were aware of the relationship. Subcommittee interviews of Teresa Pesce (3/30/2012) and 
Alan Ketley (2/26/2012). 

1294 12/1/2006 email from HBUS Alan Ketley to HBUS Stephen Allen, HSBC Salman Hussain and others, "Al Rajhi 
Bank," OCC-PSI-00150892. Ms. Pesce confirmed to the Subcommittee that the HBUS relationship with Al Rajhi 
Bank was limited to a banknotes relationship. Subcommittee interview of Teresa Pesce (3/30/12). 

1295 12/1/2006 email from HBUS Alan Ketley to HBUS Stephen Allen, HSBC Salman Hussain and others, "Al Rajhi 
Bank," OCC-PSI-00150892. 

1296 "Former U.S. Head of Al-Haramain Islamic Foundation Sentenced to 33 Months in Federal Prison," U.S. 
Attorney's Office for the District of Oregon press release (9/27/1 1) at 1. 
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internal HSBC emails indicate that two other major factors in the decision to restore the 
account were the threat made by Al Rajhi Bank to withdraw its business, and the promise 
of new revenue exceeding $100,000 per year. 

H. 2007 to 2010: Additional Troubling Information 

The HBUS Banknotes account for Al Rajhi Bank was formally reestablished on 
December 4, 2006. 1297 Once the account was reinstated, HBUS London Banknotes 
began supplying an estimated average of $25 million in physical U.S. dollars per month 

1298 

to Al Rajhi Bank in Saudi Arabia. HBUS informed the Subcommittee that over the 
next four years Al Rajhi Bank purchased nearly $1 billion in U.S. dollars from HBUS, 
while selling back less than $10 million. The annual totals are as follows. 

U.S. Dollars Sold to Al Rajhi Bank U.S. Dollars Purchased from Al Rajhi Bank 



2006 $ $ 

2007 $ 123 million $ 8 million 

2008 $ 202 million $ 

2009 $ 369 million $ 

2010 $ 283 million $0 

Grand total: $ 977 million $ 8 million 



Over the next three years, troubling information about Saudi Arabia in general 
and Al Rajhi Bank in particular continued to circulate, but neither HSBC nor HBUS 
engaged in another round of internal deliberations over whether to maintain the account. 
Instead, HBUS's Hong Kong branch opened a new line of banknotes trading with Al 
Rajhi Bank. 

In July 2007, the Wall Street Journal published two lengthy articles by reporter 
Glenn Simpson examining Al Rahji Bank's links to terrorism. 1300 The first article 
disclosed the existence of the 2003 CIA report, "Al Rajhi Bank: Conduit for Extremist 
Finance," and quoted its statement that "[s]enior al-Rajhi family members have long 
supported Islamic extremists and probably know that terrorists use their bank." The 
article repeated the information that the name of the bank's most senior official, Sulaiman 
bin Abdul Aziz Al Rajhi, had appeared on al Qaeda's list of 20 early financial 
benefactors. 1301 After the first article was published, HBUS' primary U.S. regulator, the 
OCC, asked HBUS to respond to its allegations. 1302 



129/ See 2010 HSBC KYC Profile of Al Rajhi Bank at 13. 

1298 See 7/26/2007 email from HBUS Daniel Jack to HBUS Alan Ketley, "BN-LN with Al Rajhi Bank in Saudi 
Arabia," HSBC OCC 1413726. 

1299 Subcommittee briefing by HSBC legal counsel (7/9/2012). 

noo < v s Tracks Saudi Bank favored by Extremists," Wall Street Journal , Glenn Simpson (7/26/2007); "Reported 
U.S. Concerns over Saudi Bank leave Compliance Officers Reading Tea Leaves," Wall Street Journal , Glenn 
Simpson (7/27/2007). 

1301 "tj s Tracks Saudi Bank Favored by Extremists," Wall Street Journal , Glenn Simpson (7/26/2007). 

1302 7/26/2007 email from OCC Joseph Boss to HBUS Alan Ketley, "Saudi's," HSBC OCC 3391 185. 
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1303 

Also in 2007, reports by the U.S. Department of State and the Congressional Research 
Service 1304 stated that Saudi Arabia continued to be a source of financing for Al Qaeda and other 
terrorist organizations, and expressed particular concern about the use of cash couriers to deliver 
funds outside of the country. In September, on the sixth anniversary of the 9/1 1 attack, Treasury 
Under Secretary Levey said in a televised interview on terrorist financing: "[I]f I could 
somehow snap my fingers and cut off the funding from one country, it would be Saudi 
Arabia." 1305 In August 2007, Congress enacted legislation expressing concern about Saudi 
Arabia's uneven role in terrorist financing. 1306 

In April 2008, Treasury Under Secretary Levey testified that, while Saudi Arabia had 
taken strong action against terrorists operating within its borders and was cooperating with the 
United States on an operational level, it was not working as hard to prevent funds from flowing 
to terrorists outside of its borders: "Saudi Arabia today remains the location from which more 
money is going to terror groups and the Taliban - Sunni terror groups and the Taliban - than 
from any other place in the world." 1307 

The 2009 GAO report prepared for Congress stated: "U.S. officials remain concerned 
about the ability of Saudi individuals and multilateral charitable organizations, as well as other 
individuals visiting Saudi Arabia, to support terrorism and violent extremism outside of Saudi 
Arabia." 1JUO Also in 2009, HBUS received an inquiry from the IRS Criminal Investigation 
Division asking for contact information for the U.S. agent that receives service of process in the 
United States on behalf of Al Rajhi Bank. 1309 In response, HBUS AML compliance officer 
Daniel Jack reviewed the bank's account activity for the prior 12 months. He wrote: 

"This bank (an SCC) had a long-standing relationship (25+ years) with Banknotes- 
London until we closed the account in Feb-05 due to TF [Terrorist Financing] & 
reputational risk. With approval from AML (A. Ketley), London re-opened the BN 
[Banknotes] account in Dec-06 with SCC classification due to PEP. This client still has 
relationships with HSBC in the UK, UAE, France, Hong Kong and Italy. . . . Following is 
a listing of all traders' explanations provided for alerts over the past 7+ years." 1310 

His analysis disclosed that, over the prior 12 months, HBUS had provided Al Rajhi Bank with 
over $200 million in U.S. dollars. 1311 



1303 See 2007 International Narcotics Control Strategy Report, U.S. State Department, at 355. 

1304 See 2007 CRS Report on Saudi Arabia Terrorist Financing Issues, in the summary. 

1305 "U.S.: Saudis Still Filling Al Qaeda's Coffers," ABC News, Brian Ross (9/11/2007). 

1306 See Section 2043(c), Implementing Recommendations of the 9/11 Commission Act, P.L. 110-53 (8/3/2007). 

1307 

Stuart Levey testimony before Senate Committee on Finance, "Anti-Terrorism Financing: Progress Made and 
Challenges Ahead," (4/1/2008). 

no8 "c om b a ting Terrorism: U.S. Agencies Report Progress Countering Terrorism and Its Financing in Saudi 
Arabia, but Continued Focus on Counter Terrorism Financing Efforts Needed." U.S. Government Accountability 
Office, GAO-09-883 (Sept. 2009), http://www.gao.gov/new.items/d09883.pdf, at 29. 

1309 See 5/12/2009 HBUS email exchange, "Al-Rajhi Banking and Investment Corporation, Saudi Arabia," OCC- 
PSI-00823520, with attachments [no bates numbers]. 

1310 Id. 

1311 Id. 
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In 2010, the al Haramain Foundation trial got underway related to the cashing of 
$130,000 in travelers cheques at Al Rajhi Bank in Saudi Arabia to help violent extremists in 
Chechnya. Prior to the trial, the United States served a subpoena on Al Rajhi Bank to obtain 
authenticated bank documents for use in the trial, but the bank refused to produce the documents 

1312 

and moved to quash the subpoena, leading to "negative news articles," in the words of the 
2010 KYC client profile prepared by HBUS for Al Rajhi Bank. 1313 The trial court denied the 
bank's motion, 1314 and the case was later closed as "moot." 1315 

One other 2010 development was action taken by an Al Rajhi related money exchange, 
Tahweel Al Rajhi, to join with the largest bank in Pakistan, Habib Bank Ltd., to initiate a new 
funds transfer product called "HBL Fast Cash." The new product was designed to allow the 
instant transfer of funds from Riyadh, Saudi Arabia, to any Habib branch in Pakistan, whether or 
not the sender or recipient of the funds had an account at either financial institution. According 
to one media report, Hazem Elhagrasey, the head of Tahweel Al Rajhi, said: "The new service 
will assure that the beneficiaries will receive payments in cash within minutes in Pakistan." 1316 
Tariq Matin Khan, Habib Bank's general manager for financial institutions and international 
banking, said: "The remitters can benefit from the huge HBL network to send money to any 
nook or corner of Pakistan." 1317 The Subcommittee intended to ask Al Rajhi Bank about AML 
safeguards to prevent misuse of this new transfer mechanism, but the bank declined to provide 
any information in response to the Subcommittee's inquiry. It is unclear whether Tahweel Al 
Rajhi has an account at Al Rajhi Bank. 

Meanwhile, from 2007 to 2010, HBUS continued to supply, through its London 
branch, hundreds of millions of U.S. dollars to Al Rajhi Bank in Saudi Arabia. In 
addition, at Al Rajhi Bank's request, HBUS expanded the relationship in January 2009, 
by authorizing its Hong Kong branch to supply Al Rajhi Bank with non-U. S. currencies, 

1318 

including the Thai bat, Indian rupee, and Hong Kong dollar. At the time, Gloria 
Strazza, a senior official in HBUS's Financial Intelligence Group, observed: "There was 
(and may be in the future) a fair amount of press and government attention focused on 
this entity. I am not sure we would want to engage in even this limited activity for this 



1312 See Al Rajhi Banking & Investment Corp. v. Holder , Case No. l:10-MC-00055-ESH (USDC OR 1/19/10). 

1313 2010 HBUS KYC Profile of Al Rajhi Bank at 6. See also 12/6/201 1 HSBC AMLID Case #1434 for Al Rajhi 
Bank, HSBC-PSI-PROD-0 102340-342. 

1314 United States v. Sedaghaty , (USDC D OR), 2010 U.S.Dist.LEXIS 144171, Order (1/12/2010). 

1315 See Al Rajhi Banking & Investment Corp. v. Holder , Case No. l:10-MC-00055-ESH, Order Dismissing Action 
As Moot (3/2/2010). 

ni6 "TerrcH-.jirikecl Saudi bank launches major remittance program to Pakistan," Khaleej Times in Saudi Arabia 
(4/10/2010), http://www.khaleejtimes. com/biz/inside. asp?xfile=/data/business/2010/April/business_ 
April 1 83. xml&section=business&col=. 

1317 Id. 

1318 See 2010 HBUS Hong Kong office KYC Customer Profile for Al Rajhi Bank, HSBC_PSI_PROD-0 102304-306 
(showing Hong Kong account for Al Rajhi Bank began trading 1/29/2009). See also 4/3/2008 email from HBME 
Salman Hussain to HBMD David Illing and HBEU John Scott, "Al Rajhi Bank, Saudi Arabia," OCC-PSI-00 156271 
(showing Al Rajhi Bank requested the Hong Kong account); 5/5/2008 exchange of emails among HBUS 
Christopher Lok, Gary Yeung, Stephen Allen, and others, "KYC Approval needed for: Al Rajhi Banking & 
Investment Corp," OCC-PSI-00155719; 6/2/2008 email from HBUS Daniel Jack to HBUS Anne Liddy, Gloria 
Strazza, Alan Williamson and others, "Banknotes with Al Ra[jh]I Banking in S.A.," OCC-PSI-00343451. 
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entity but I forward some of the intelligence from our files on this bank." liiy Mr. Lok 
responded: "This is an on-going debate that will never go away. My stance remains the 
same, i.e. until it[']s proved we cannot simply rely on the Wall Street Journal['s] reports 
and unconfirmed allegations and 'punish' the client." 1320 In a later email, Mr. Lok 
commented: "LON [London Banknotes office] already has a relationship with Alrajhi. 

1321 

Adding HKG [Hong Kong Banknotes office] won't change Alrajhi' s profile." AML 
compliance officer Daniel Jack offered this comment to his fellow compliance officer, 
Alan Williamson, regarding the account: "I believe the business owns the customer and 
the risk. ... I don't think you should CO [Compliance Office] deny - or even hesitate 
now - on this for HK [Hong Kong], despite the negative info on TF [Terrorist Financing] 
& Rep[putational] risk, which is not new (e.g. WSJ in Jul-07, EDD in Dec-07). I 
understand why Denise/ Anne/Gloria are not comfortable, but I respectfully do not think it 
is their decision to terminate the relationship (again)." 1322 HBUS decided to open the 
Hong Kong account, 1323 providing Al Rajhi Bank on average another $4.6 million per 
month in non-U. S. currencies. 1324 

HBUS Banknotes finally ceased doing business with Al Rajhi Bank when, in 
September 2010, HSBC made a global decision to exit the U.S. banknotes business, one 
week after the OCC sent a lengthy Supervisory Letter to the bank criticizing its AML 
program, including with respect to its handling of banknotes. 1325 



6/3/2008 exchange of emails among HBUS Gloria Strazza, Daniel Jack, Christopher Lok, Stephen Allen, and 
others, "Banknotes with Al Ra[jh]i Banking in S.A.," HSBC OCC 0752005-006. AML compliance officer Daniel 
Jack forwarded her email to Mr. Lok, Mr. Allen, and others, noting "there is still some concern in AML/ICRO 
regarding TF [Terrorist Financing] & reputational risk in dealing with [Al Rajhi]," and asked for an email to 
"address the negative info, risk analysis and appropriateness of mitigants, and your support for maintaining the 
HBUS relationship." Id. 

1320 Id. 

1321 7/18/2008 email from HBUS Christopher Lok to HBUS Alan Williamson and others, "Banknotes with Al 
Ra[jh]I Banking in S.A.," HSBC OCC 0760928. 

1322 6/3/2008 email from HBUS Daniel Jack to HBUS Alan Williamson, "Banknotes with Al Ra[jh]I Banking in 
S.A.," HSBC OCC 1638463. See also 5/30/2008 emails exchanged among HBUS Daniel Jack, Alan Williamson, 
and Betty NG, "KYC BankNote Profile is IB Approved for: Al Rajhi Banking & Investment," OCC-PSI-00239206; 
HSBC OCC 1638463. 

1323 In July 2008, Mr. Williamson approved the new account and wrote to Mr. Lok, "You're in business now." 
7/18/2008 email exchange between Alan Williamson, Christopher Lok and others, "Banknotes with Al Ra[jh]I 
Banking in S.A.," HSBC OCC 0761014. 

1324 See HBUS Hong Kong office KYC Customer Profile for Al Rajhi Bank, HSBC_PSI_PROD-0 102304-306, at 2. 

1325 See 9/20/2010 "HSBC to Exit Asian Banknotes Business," HSBC Holdings pic Announcement, 
http://www.hsbc.eom/l/PA_esf-ca-app-content/content/assets/investor_relations/sea/ 2010/sea_100920_ 
wholesale_banknotes_en.pdf. See also 2010 HBUS KYC Profile on Al Rajhi Bank, at 1 (showing account 
deactivated on 10/14/2010); 2010 HBUS Hong Kong office KYC Profile on Al Rajhi Bank, HSBC_PSI_PROD- 
0102304-306, at 1 (showing Hong Kong account deactivated on 10/29/2010). In addition, in October 2010, both the 
OCC and Federal Reserve issued Cease and Desist Orders to HBUS and its parent holding company, HNAH, to 
require them to revamp their AML programs. 
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I. Servicing Other Banks with Suspected Links to Terrorism 

Al Rajhi Bank was not the only bank with suspected links to terrorist financing serviced 
by HSBC. Two others were Islami Bank Bangladesh Ltd. and Social Islami Bank Ltd. Both 
banks cooperated with the Subcommittee's inquiries. 

(1) Islami Bank Bangladesh Ltd. 

Islami Bank Bangladesh Ltd. opened its doors in 1983, designed its operations to be in 
conformance with Islamic requirements, and has grown to become one of the largest private 
banks in Bangladesh, which is one of the most densely populated countries in the world. 1326 It 
provides a wide variety of individual and commercial banking services. Several of the bank's 
most senior officials were politically important figures within the country or in Saudi Arabia, 
leading to their designations as Politically Exposed Persons in the World Check database. 
According to Islami Bank Bangladesh, it has an extensive network of more than 600 
correspondent accounts. 1329 

Islami Bank Bangladesh applied to open accounts with HSBC in 2000, and currently has 

1330 

accounts with HSBC in 24 locations around the world. According to the bank, it opened a 
U.S. dollar account with HBUS in 2000, and U.S. dollar clearing accounts with HSBC India and 
HSBC Pakistan in 2006. In 2007, the HBUS branch in Singapore also sought approval to open 
an account for the bank to supply it with physical U.S. dollars, cash U.S. dollar monetary 
instruments such as travelers cheques and money orders, process U.S. dollar wire transfers, and 
provide other services. 1331 

Opening 2007 HBUS Account. Documents show that proposals to open the 2007 
HBUS account for Islami Bank immediately raised AML concerns within HBUS AML 
Compliance, not only because the bank was located in a country ranked by HSBC as at 
"high risk" of money laundering 1332 and ranked by Transparency International as one of 
the most corrupt country in the world, but also because members of the Al Rajhi 
group held a 37% direct ownership interest in the bank. 



See Islami Bank Bangladesh Ltd. website, "About IBBL," 
http://www.islamibankbd.com/abtIBBL/abtIBBLAtaGlance.php; 4/19/2005 HSBC FIG report on Islami Bank Ltd.- 
Bangladesh, HSBC OCC 3241695; 7/4/2012 email from Islami Bank Bangladesh Ltd. to Subcommittee, PSI-IBBL- 
01-0001. 

1327 See Islami Bank Bangladesh Ltd. website, "Products & Services," 
http://www.islamibankbd.com/prodServices/prodServices.php 

1328 See 4/19/2005 HSBC FIG report on Islami Bank Ltd. -Bangladesh, at HSBC OCC 3241696; 5/1 1/2006 FIG 
report on Islami Bank Bangladesh, HSBC OCC 3241693. 

1329 7/4/2012 email from Islami Bank Bangladesh Ltd. to Subcommittee, PSI-IBBL-0 1-0001. 

1330 See HBUS Know Your Customer Profile of Islami Bank Bangladesh Ltd. (3/9/2012), HSBC-PSI-PROD- 
01 17222-237 (hereinafter "2012 HBUS KYC Profile of Islami Bank"), at 2; 7/4/2012 email from Islami Bank 
Bangladesh Ltd. to Subcommittee, PSI-IBBL-0 1-0001. 

1331 See 2012 HBUS KYC Profile of Islami Bank at 2. 

1332 See 2012 HBUS KYC Profile of Islami Bank at 1. 

1333 See 2007 "Corruption Perceptions Index," Transparency International, 

http://archive.transparency.org/policy_research/surveys_indices/cpi/2007 (ranking Bengladesh as 162 out of 180 
countries in terms of perceived levels of corruption). 
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In the fall of 2007, Kwok Ying Fung at the HBUS office in Singapore asked Beth 
Fisher at HBUS AML Compliance to approve Islami Bank's KYC profile, but she 
declined without explaining why. 1334 On October 24, 2007, after receiving her response, 
he asked HBUS AML Compliance to suggest someone else to approve opening the 

1335 

account. Angela Cassell-Bush suggested that he "reach out to Chris Lok to see if he 
is willing to be the RM [Relationship Manager] Approver." 1336 Ms. Fisher warned her 
colleagues that, given the connection between the Bangladeshi bank and Al Rajhi Bank, 
"[t]his is not just an RM issue. This is a KYC due diligence issue." 

On November 6, 2007, Mr. Fung asked Mr. Lok, head of HSBC Global Banknotes 
and located in HBUS offices in New York, if he would consider serving as the "RM 
[Relationship Manager] approver" of the Islami Bank KYC profile, so that the bank could 
become a "shared client" of HBUS Banknotes and HBUS Payments and Cash 

1338 

Management (PCM). On November 8, 2007, Mr. Lok responded that his interest in 
considering a new account depended upon whether there was enough potential revenue to 
make the effort of vetting Al Rajhi worth it: 

"First, I'm happy to be the RM [Relationship Manager] if this is an account worth 
chasing. How much money can you expect to make from this name? If this can be 
answered positively then I will ask PCM to check out the ... alrajhi connection. . . . 
The name Alrajh has been a name heatedly debated for many years. We terminated 
our trading relationship following 911 and only a year ago after London Compliance 
came back telling NYK the group is happy to let us resurrect the relationship that we 
went back. . . . Not saying just because of this connection we won't do business. 
It[']s just that if the revenue is there then we're prepared for a good fight." 

Mr. Lok' s email suggests that he expected from the outset that HBUS AML Compliance 
would resist opening an account for Islami Bank and it would take a "fight" to open the 
account. 

Later the same day, Benjamin Saram of HBUS Singapore emailed Mr. Lok and 
others with information about the likely revenues if an account were opened for Islami 
Bank. He wrote that, because approximately 60,000 Bangladeshis traveled to Saudi 
Arabia each year on religious pilgrimages and would require about $1,000 to $3,000 
each, "we're therefore looking at about USD 60 mio [million] of currency needs on an 



1334 See 10/24/2007 email from HBUS Kwok Ying Fung to HBUS Jarrett Payne and Angela Cassell-Bush, "KYC 
BankNotes Profile is IB Denied for: Islami Bank Bangladesh Limited," HSBC OCC 0739990-991. 

1335 Id. 

1336 1 1/6/2007 email from Angela Cassell-Bush to Kwok Ying Fung with copies to Beth Fisher and others, "KYC 
BankNotes Profile is IB Denied for: Islami Bank Bangladesh Limited," HSBC OCC 0739990. 

1337 1 1/7/2007 email from HBUS Beth Fisher to HBUS Angela Cassell-Bush and others, "KYC BankNotes Profile is 
IB Denied for: Islami Bank Bangladesh Limited," HSBC OCC 0739989. 

1338 1 1/6/2007 email from HBUS Kwok Ying Fung to HBUS Christopher Lok, "Islami Bank Bangladesh Limited," 
HSBC OCC 0739989. 

1339 

1 1/8/2007 email from HBUS Christopher Lok to HBUS Kwok Ying Fung and others, "Islami Bank Bangladesh 
Limited," HSBC OCC 0739988-989. 
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annual basis." 1340 He noted that, in 2006, HBUS Banknotes had netted about $47,000 in 
profits in Bangladesh, and expected a 53% increase in 2007, to about $75,000, 
explaining, "[w]e are a monopoly here, and margins are decent." 1341 Mr. Saram 
estimated that, if an account were opened for Islami Bank, the "net profit would be 
approximately USD 75,000/ year." 

Mr. Lok responded: "One, the money is there and we should go for this account. 
Two, I will jump in and wear the GRM [Global Relationship Manager] hat. ... I believe 
we should be able to get the K[YC] sign off." 1342 He also asked HBUS AML 
Compliance to look into the possible connection between Islami Bank and Al Rajhi Bank. 

The next day, November 9, 2007, HBUS AML compliance officer Angela Cassell- 
Bush confirmed a direct link between the two banks: 

"[P]lease note that there is a connection between ISLAMI BANK BANGLADESH 
LIMITED-Bangladesh and Al-Rajhi Bank .... Based on the information we have on 
file, the Al - Rajhi family has been associated with Islami Bank Bangladesh Limited, 
since its inception. They have at least 37% direct ownership . . . through their 
ownership within the following companies: Arabsas Travel & Tourist Agency, 
9.999%; Janab Yousif Abdullah Abdul Aziz Al-Rajhi, 9.936%; Al-Rajhi Company 
for Industry & Trade, 9.94%; Abdullah Abdul Aziz Al-Rajhi, 7.58%. This same 
family has major controlling interest within Al-Rajhi bank." 1343 

Troubling Information. HBUS' Singapore branch actually opened the account for 
Islami Bank in December 2007. 1344 Mr. Lok and others approved the account, despite 
ongoing questions about its primary shareholder, Al Rajhi Bank, whose past links to 
terrorist financing had received additional attention in the media during the summer of 
2007. HBUS also approved the account despite troubling information about Islami Bank 
itself. 



1 1/8/2007 email from HBUS Benjamin Saram to HBUS Christopher Lok, Kwok Ying Fung, and others, "Islami 
Bank Bangladesh Limited," HSBC OCC 0739987-988. 

1341 Id. 

1342 1 1/8/2007 email from HBUS Christopher Lok to HBUS Benjamin Saram, Kwok Ying Fung, and others, "Islami 
Bank Bangladesh Limited," HSBC OCC 0739987. 

1343 1 1/9/2007 email from HBUS Angela Cassell-Bush to HBUS Christopher Lok, and others, "Islami Bank 
Bangladesh Limited-Bangladesh," OCC-PSI-00154139, at 1. Mr. Lok asked Ms. Cassell-Bush to 
doublecheck one of the shareholders, Abdullah Abdul Aziz Al-Rajhi, who was listed as holding 7.58% of 
the shares, suggesting that the wrong company may have been identified as the shareholder. A later email 
suggested that the shareholding company was not a member of the Al Rajhi group. See November and 
December 2007 exchange of emails among HBUS Christopher Lok, Angela Cassell-Bush, Muhammad 
Shohiduzzaman, and others, "Islami Bank Bangladesh Limited-Bangladesh," HSBC OCC 0741466-469. 
Later KYC profiles for the bank indicate, however, that the shares were, in fact, held through a company 
that was part of the Al Rajhi group. See, e.g., 2012 HBUS KYC Profile of Islami Bank at 7. Islami Bank 
Bangladesh Ltd. has confirmed to the Subcommittee that Abdullah Abdul Aziz Al Rajhi has been both a 
shareholder and director of the bank. 7/4/2012 email from Islami Bank Bangladesh Ltd. to Subcommittee, 
PSI-IBBL-0 1-0001. 

1344 See 2012 HBUS KYC Profile of Islami Bank at 15. 
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The troubling information about Islami Bank was contained in an internal report that 
had been prepared less than a year earlier by HSBC's Financial Intelligence Group 
(FIG). 1345 The May 2006 FIG report disclosed that, in March 2006, "Abdur Rahman, 
chief of the Jamaatul Mujahideen of Bangladesh (JMB), and his second-in-command, 
Bangla Bhai, were arrested for being responsible for the terrorist bomb blasts of August 
17, 2005 in Bangladesh." 1346 The FIG report noted that Mr. Rahman had been found to 
have an account at Islami Bank. 1347 

The FIG report also disclosed that an investigation by the Central Bank of 
Bangladesh found that two branches of Islami Bank had been engaged in "suspicious 
transactions" and urged the bank to take action against 20 bank employees, including for 
failing to report the suspicious transactions. 1348 According to the FIG report, in response, 
Islami Bank reportedly suspended five officers and warned 15 others. 1349 The FIG report 
stated that Bangladeshi news articles had observed it was the third time Islami Bank had 
been fined by the Central Bank "for covering up militants' transactions." 1350 

Islami Bank's KYC profile repeated this information and indicated that the HSBC 
Global Relationship Manager had visited the bank to ask about the matter, and was told 

i o c 1 

that the incident did not involve terrorist financing. The Global Relationship Manager 
advised against taking any further action, attributing the AML failures to the bank's 
unsophisticated technology platform. 1352 Neither the KYC profile nor the FIG report 
indicate whether any steps were taken to verify the bank's explanation of the incident 
with the Central Bank. The KYC profile noted that, in 2006, FIG recommended 
classifying Islami Bank as a "Special Category Client," or SCC, HSBC's designation for 
its highest risk clients, but that recommendation was rejected, which meant HSBC did not 
subject the bank to any enhanced monitoring. 1353 

2009 Information on IIRO Accounts. The account was opened near the end of 
2007. About 18 months later, in May 2009, a FIG due diligence report prepared for 
another Bangladeshi bank with which HBUS did business, Social Islami Bank, discussed 
below, disclosed new information relevant to Islami Bank. This information related to 
the International Islamic Relief Organization (IIRO), a Saudi nonprofit organization 
which, in 2006, had two of its branches and a high ranking IIRO official designated by 



1345 See 5/1 1/2006 FIG report on Islami Bank Bangladesh, HSBC OCC 3241692-694. 

1346 Id. at HSBC OCC 3241693. 

1347 Id. Islami Bank Bangladesh Ltd. told the Subcommittee, however, that it has never had an account for 
Abdur Rahman. 7/4/2012 email from Islami Bank Bangladesh Ltd. to Subcommittee, PSI-IBBL-01-0001 

1348 5/1 1/2006 FIG report on Islami Bank Bangladesh, at HSBC OCC 3241693. 

1349 Islami Bank Bangladesh told the Subcommittee that it suspended and later fired the bank officials 
involved. 7/4/2012 email from Islami Bank Bangladesh Ltd. to Subcommittee, PSI-IBBL-01-0001. 

1350 5/1 1/2006 FIG report on Islami Bank Bangladesh, at HSBC OCC 3241693. 

1351 2012 HBUS KYC Profile of Islami Bank at 3. 

1352 Id. (The Global Relationship Manager wrote: "[C]onsidering that Islami Bank is involved in mass banking with 
a pretty large branch network without a sophisticated or integrated IT platform, there will always be a chance that 
isolated incidents like this might be found. As such, we will closely monitor the future events and keep you 
informed as soon as any issue of concern is detected."). 

1353 Id. 
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the United States as terrorist financiers and added to the list of entities with which U.S. 
persons are prohibited from doing business. 1354 

The 2009 FIG report stated that the IIRO had accounts at both Social Islami Bank 
and Islami Bank. It quoted a 2008 local press article saying that, in response to the 
action taken by the United States in 2006, Islami Bank had frozen its IIRO accounts. 1356 
The FIG report did not indicate when the accounts were first opened, what actions had 
been taken beyond freezing them, or how much money was involved. In 2010, an HBUS 
KYC profile for Social Islami Bank referenced a letter from the Bangladeshi Central 
Bank, dated June 30, 2010, indicating that IIRO had accounts at three Bangladeshi banks, 

1 357 

including Islami Bank, which needed to be closed. 

Islami Bank Bangladesh confirmed to the Subcommittee that IIRO had two 
accounts at the bank which opened in 1993 and 1994, when IIRO was a nongovernmental 

1 358 

organization in good standing. It stated that after the IIRO was added to a United 
Nations sanctions list in 2006, it froze the accounts and reported them to the Bangladeshi 
Central Bank. In 2010, according to the bank, it received an "instruction from the Central 
Bank at the direction of [the] Ministry of Finance" to unfreeze the accounts and "transfer 
the accounts" to a government owned bank, BASIC Bank, which it did. 1359 

Despite the 2008 published article, the information in the two internal HBUS 
documents related to Social Islami Bank, and Islami Bank Bangladesh's willingness to 
discuss the accounts, no information about the IIRO accounts appeared in the HBUS 
KYC profile for Islami Bank. While the IIRO accounts at Social Islami Bank were the 
focus of extensive discussions in emails and other documents by HBUS AML 
Compliance personnel and HBUS bankers working in Bangladesh, no similar discussions 
appear in any of the HBUS documents related to Islami Bank. 

In September 2009, the Islami Bank KYC profile indicates that an unnamed HSBC 
employee requested a new enhanced due diligence report on the bank. 1360 HBUS Compliance 
denied the request, indicating an update "is NOT needed at this time." 1361 

2010 SCC Designation. In February 2010, HBUS AML Compliance personnel 
reviewed the Islami Bank account and recommended that the bank be designated an SCC 



See 8/3/2006 "Treasury Designates Director, Branches of Charity Bankrolling Al Qaida Network," U.S. 
Treasury Department press release, reprinted in 8/2/2006 email from HBUS Sharyn Malone to HBUS Stephanie 
Napier and others, "Social Investment Bank, Bangladesh," HSBC OCC 3259936. 

1355 See 5/5/2009 FIG Report of Findings on Social Investment Bank Limited, OCC-PSI-00823818, at 7 (quoting 
10/8/2008 article from Bangladeshnews.com). 

1356 Id. 

1357 2012 HBUS KYC Profile of Social Islami Bank at 4 ("The 3 bank accounts of IIRO namely i) Social Islami 
Bank Ltd. ii) Islami Bank Bangladesh Ltd. iii) Al-Falah Islami Bank Ltd. must be disposed off [sic] and 
transferred"). 

1358 7/4/201 2 email from Islami Bank Bangladesh Ltd. to Subcommittee, PSI-IBBL-01-0001-003, at 003. 

1359 Id. 

1360 2012 HBUS KYC Profile of Islami Bank at 2. 
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client. 1362 One key reason given for the proposed SCC designation was Islami Bank's 
links to the Al Rajhi group, noting that the Vice Chairman of the bank and 10% owner 
was Yousif Abdullah Al Rajhi, that Al Rajhi interests held about a third of the bank's 
shares, and Al Rajhi itself had links to terrorist financing. Another reason given was 
the information provided in the 2006 FIG report, that the Bangladeshi Central Bank had 
issued a "notice of cause" to Islami Bank "to explain accounts owned by suspected 
Islamic Militants," and reportedly fined the bank for the third time "for covering up 
militants['] transactions." 364 No mention was made of the IIRO accounts. Contrary to 
the outcome in 2006, in 2010, HSBC designated Islami Bank as an SCC client. 1365 

Later in 2010, an OCC AML examiner reviewing emails related to Islami Bank 
characterized the information provided about the bank as depicting "extreme 
circumstances," and recommended that the account be reviewed as part of a larger AML 
"look back" effort at HSBC. 1366 In 201 1, HSBC engaged in an extensive discussion with 
Islami Bank regarding its AML policies and procedures, also noting in its KYC profile 
that the bank acted as a "payout agent" for 53 money exchange businesses across the 
Middle East. 1367 

Today, although HSBC exited the U.S. banknotes business in 2010, Islami Bank 
Bangladesh remains a customer of two dozen HSBC affiliates, including HBUS PCM, 
which continues to provide Islami Bank with access to U.S. dollars, U.S. wire transfers, 
and U.S. payment systems. 

(2) Social Islami Bank Ltd. 

A third bank serviced by HSBC despite suspected links to terrorist financing is 
Social Islami Bank Ltd. 

Social Islami Bank Ltd. was founded in 1995, changed its name from Social 
Investment Bank Ltd. in 2009, and is located in Bangladesh. 1369 It operates 76 branches 
throughout the country and provides a variety of individual and commercial banking 
services, including deposits, loans, investment advice, commercial financing, foreign 
exchange, and wire transfers. It operates in conformance with Islamic requirements and 
is publicly traded on Bangladeshi stock exchanges. Its headquarters are in Dhaka, the 
capital of Bangladesh, one of the world's largest cities with a population of 16 million. 



See 2/3/2010 email exchange between HBUS Jon K. Jones, Ali Kazmy and others, "Islami Bank Bangladesh Ltd 
- Poss SCC," OCC-PSI-00453499-500. 

1363 Id. 

1364 Id. 

1365 Id. See also 2012 HBUS KYC Profile of Islami Bank at 3. 

1366 10/27/2010 email from OCC AML Examiner Joseph Boss to OCC colleagues, OCC-PSI-009 19631. 

1367 2012 HBUS KYC Profile of Islami Bank at 3-4. 

1368 2012 HBUS KYC Profile of Islami Bank at 2, 7. 

1369 See Social Islami Bank website, http://www.siblbd.com/html/homepages.php; HBUS "Know Your Customer 
Profile" of Social Islami Bank Ltd. (2/7/2012), HSBC-PSI-PROD-0102782-789 (hereinafter "2012 HBUS KYC 
Profile of Social Islami Bank"), at 2. 
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Until May 2012, HSBC was one of the bank's major correspondents, providing it 

1 370 

with services in multiple countries. HSBC also has an affiliate located in Dhaka. 
That affiliate, HSBC Bank Asia Pacific (HBAP) Dhaka, introduced Social Islami Bank to 
HBUS. 1371 In 2003, HBUS Payments and Cash Management (PCM) sought to open an 
account for Social Islami Bank, providing it with U.S. dollar wire transfer and clearing 

1372 

services. 

Opening of HBUS Account. When HBUS first sought to open the account in 2003, it 
asked for an enhanced due diligence report on the bank from the HSBC Financial Intelligence 
Group (FIG). In addition to noting that Bangladesh was a high risk country due to its reputation 
for corruption, the resulting FIG report contained adverse information about some of the bank' s 
owners and officials. Most serious were allegations that two shareholders, the International 
Islamic Relief Organization (IIRO) and the Islamic Charitable Society Lajnat al-Birr Al Islam 
(Lajnat al-Birr), had links to terrorism. IIRO then held 8.62% of the total outstanding shares, and 
was the bank's largest single shareholder, while Lajnat al-Birr held 1.54%. 

The 2003 FIG report stated the following with regard to the two shareholders: 

"IIRO is a Saudi- Arabian charity. . . . The IIRO was named in the 2002 lawsuit 
brought forward on behalf of family members of victims of the September 11, 
2001 terrorist attacks. The IIRO was accused of having 'played key roles in 
laundering of funds to terrorises] for the 1998 African embassy bombings' and 
having been involved in the 'financing and aiding and abetting of terrorists in the 
1993 World Trade Center bombing.' The IIRO has also reportedly funded al- 
Qaeda directly as well as several of its satellite groups. Osama bin Laden' s 
brother-in-law, Mohammed Jamal Khalifa, headed the Philippine branch of the 
IIRO in the 1990's. The Philippine government has charged that the group 
contributed to terrorist causes there. 374 ... 



Lajnat al-Birr Al Islamiah was established in 1987. It has been stated that Lajnat 
al-Birr Al Islamiah was the original name of the Benevolence International 
[Foundation, and that it originally had offices in Saudi Arabia and Pakistan. 
According [to] the U.S. government, among the purposes of Lajnat was to 'raise 
funds in Saudi Arabia to provide support to the Mujahadeen then fighting in 
Afghanistan,' as well as to provide 'cover for fighters to travel in and out of 
Pakistan and obtain immigration status.' Benevolence International has been tied 
to terrorism and its director, Enaam Arnaout, was indicted in 2002 with 
conspiring to defraud his group's donors by secretly providing financial and 
logistical help to al-Qaeda for a decade." 



1370 See Social Islami Bank website, "List of Correspondents/ Agency Arrangements Overseas," 
http://www.siblbd.com/download/CorrespondentsAgencyArrangementsOverseas.pdf. 

1371 2012 HBUS KYC Profile of Social Islami Bank at 7. 

1372 Id. at 2, 14. 

1373 See 1 1/2003 Report on Findings for Social Investment Bank, Ltd., HSBC Financial Intelligence Group, OCC- 
PSI-00823818, at 18 (hereinafter "2003 FIG Report on Social Islami Bank"). 

1374 Id. at 1-2. 

1375 Id. at 2. 
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The FIG report also contained negative information about the bank's founder: 

"Dr. M.A. Mannan was the chairman and founder of Social Investment Bank Ltd. 
He was fired in 2000 after fault was found with his banking procedure. It was 
alleged that he created an obstacle to the team of Bangladesh Bank [Bangladesh's 
Central Bank] during their visit to Social Investment Bank Ltd. Additionally, he 
was accused of interfering with bank administrative work and with harassing a 
bank employee." 

The FIG report concluded: 

"In conclusion, it is of significant concern that the leading shareholder of Social 
Investment Bank Ltd. (at 8.62%), International Islamic Relief Organization, has 
been accused in both the Philippines and in America of funding terrorist groups. 
The group is currently under investigation by the F.B.I. Another of the bank's 
shareholders, Lajnat al-Birr Al Islam (at 1.54%) has also been connected to 
terrorist groups. Additionally, the bank's founder and chairman was let go on 
allegations of interference and harassment. ... Finally, it is important to note that 
Social Investment Bank Ltd. is located in Bangladesh, which was ranked as the 

1 ^77 

world's most corrupt nation by Transparency International." 

The FIG report offered this cautious analysis about whether to open an account: 

"Although the allegations presented in this report, primarily against the 
International Islamic Relief Organization (IIRO) and the Lajnat al-Birr Al 
Islamiah, are highly adverse, no U.S. or foreign government law enforcement or 
regulatory body has stated unconditionally, that these organizations are under 
sanction. The reputational risk is significant, however, and the possibility that 
further investigations by U.S. authorities may ultimately uncover substantiating 
proof of a connection to terrorism. The risk of future sanctions and the 
reputational risk based on allegations noted in this report should be measured 
against the current risks involved in our relationship when ultimately deciding a 
course of action." 1378 

While the 2003 FIG report provided significant adverse information about Social Islami 
Bank and noted that Lajnat al-Birr was the original name of the Benevolence International 
Foundation which "had been tied to terrorism," it failed to state that, in 2002, the United States 
had designated the Benevolence International Foundation as a "financier of terrorism" with 
whom U.S. persons are prohibited from doing business. 1379 This additional terrorism-related 



2003 FIG Report on Social Islami Bank at 4. 

1378 2003 FIG Report on Social Islami Bank at 1. 

1379 "T reasur y Designates Benevolence International Foundation and Related Entities as Financiers of Terrorism," 
U.S. Treasury Department press release No. PO-3632 (11/19/2002), 



233 



designation meant that when HBUS was considering whether to open an account for Social 
Islami Bank in 2003, Social Islami Bank was partially owned by two organizations associated 
with terrorist financing.. 1380 

Despite its failure to provide that additional information, the 2003 FIG report provided 
significant negative information about Social Islami Bank and squarely raised the question of 
whether HBUS should be doing business with it, given the "highly adverse" allegations. 
Nevertheless, on October 14, 2003, HBUS AML Compliance approved Social Islami Bank as an 
HBUS PCM client. In addition, despite the bank' s location in a high risk country, the 
terrorist links uncovered in connection with two of its shareholders and a director, HBUS opened 
the account without designating the bank as an SCC client warranting additional monitoring and 
due diligence reviews. HBUS immediately began providing the bank with services that included 
clearing U.S. dollar monetary instruments and U.S. wire transfers. Those services produced 
revenues from Social Islami Bank totaling about $100,000 per year. 

2005 Review. Two years after the account was opened, as part of a broader HSBC effort 
to update its KYC client profiles in 2005, Social Islami Bank was the subject of a second 
enhanced due diligence review. 1383 The resulting 2005 FIG report again identified IIRO, the 
bank's largest shareholder, as linked to terrorism, noting that it was "alleged to have provided 
funding to terrorist groups such as Al Qaeda in the past," and is "alleged to have acted as a cover 
for Al-Qaeda operations in the Philippines." 1384 The FIG report stated: "Based on the frequency 
with which the group is connected to terrorist financing in the press, it is likely that their 
activities will always be under scrutiny, and future government sanctions against the group are 

1385 

highly probable." The report also noted that Social Islami Bank did "not appear to have 
correspondent relationships with many of the other major global banking corporations." 1386 The 
FIG report "strongly recommend [ed]" that the account not be approved "until the matter is 
discussed with Senior Compliance Management." 1387 



www.treasury.gov/press-center/press-releases/Pages/po3632.aspx. See also Executive Order 13224, "Blocking 
Property and Prohibiting Transactions with Persons who Commit, Threaten to Commit, or support Terrorism" 
(9/23/2001). 

1380 The 2003 FIG Report also failed to mention that Social Islami Bank had opened an account for Al Rajhi 
Commercial Foreign Exchange. That money exchange business was part of the Al Rajhi Group, whose U.S. 
business and charitable ventures were the subject of a 2002 law enforcement search to disrupt terrorist financing. 
The FIG may have been unaware of the account at that time, although a 2005 FIG report on Al Rajhi Commercial 
Foreign Exchange disclosed it. See 7/13/2005 HBUS Financial Intelligence Group (FIG) Report of Findings 
(Update) on Al Rajhi Commercial Foreign Exchange, HSBC OCC 2725167-168. In 2005, Al Rajhi Commercial 
Foreign Exchange and seven other businesses merged into Al Bilad Bank. Id. According to bank counsel, the Al 
Rajhi Commercial Foreign Exchange account closed in July 2002. Subcommittee briefing by HSBC legal counsel 
(6/27/2012). 

1381 2012 HBUS KYC Profile of Social Islami Bank at 14. 

1382 2012 HBUS KYC Profile of Social Islami Bank at 8. 

1383 See 3/8/2005 email from HBUS Nanayo Ryan to HBUS FIG Michael Ellis, "Social Investment Bank Ltd 
Bangladesh," HSBC-PSI-PROD-0102689. 



1384 



3/10/2005 "Report of Findings - Social Investment Bank Ltd. - FIG (UPDATE)," HBUS Financial Intelligence 



Group, OCC-PSI-00823832 (hereinafter "2005 FIG Report on Social Islami Bank") at 2. 



1385 Id. 

1386 Id. 

1387 Id. 
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Despite the concerns raised in the FIG report, HBUS retained Social Islami Bank as a 
client. At the same time, to address concerns about the account, HBUS AML Compliance 
required the HSBC CEO for Bangladesh to provide annual approval of the account for it to stay 
open. 1388 Despite this requirement, the Subcommittee uncovered only one instance in which 
approval was granted, and when asked, HSBC was unable to provide any additional 
documentation. 1389 



2006 Terrorist Designation. Eighteen months later, on August 3, 2006, the United 
States designated two branches of IIRO and a high ranking IIRO official as terrorist financiers 
and prohibited U.S. persons from transacting business with them. 1390 Treasury Under Secretary 
for Terrorism and Financial Intelligence Stuart Levey said: "We have long been concerned about 
these IIRO offices; we are now taking public action to sever this link in the al Qaida network's 
funding chain." 1391 

In response, on the same day, HBUS AML Compliance placed a block on the Social 
Islami Bank account, so that no funds could be withdrawn. The email imposing the block noted 
that the Social Islami Bank brought in HBUS revenues totaling $44,000 per year. 1392 

The next day, August 4, 2006, the HSBC Financial Intelligence Group (FIG) issued an 
updated due diligence report on Social Islami Bank, containing significant adverse information 
about IIRO. Among other information, the FIG report noted that the World Check database 
relied on by HSBC for KYC information classified IIRO as associated with terrorism, linked it to 
providing assistance to al Qaeda and other terrorist organizations, and described it as "allegedly 
linked" to the 1993 World Trade Center bombing, "plots to assassinate Bill Clinton and the 
Pope," and "the planned destruction of the Lincoln Tunnel and Brooklyn Bridge." 1394 

Two days after that, on August 6, 2006, an HSBC institutional banker from HBAP 
Dhaka, Muhammad Shohiduzzaman, met with Social Islami Bank to discuss IIRO. 1395 He wrote 



1388 jjgjjo; AML head Terri Pesce told the Subcommittee it was "unusual" to obtain CEO approval of an account. 
Subcommittee interview of Teresa Pesce (3/30/2012). See, e.g., 2012 HBUS KYC Profile of Islami Bank at 14-15; 
2/9/2010 email from HBUS Jon K. Jones to HBAP Sadique Reza and others, "Compliance Conditions: Social Islami 
Bank Ltd," HSBC-PSI-PROD-0102645. 

1389 jYiis approval was provided in April 2005 by Steve Banner, HSBC Bangladesh CEO. He wrote with regard to 
Social Investment Bank: "I have been in Bagladesh for only 2 months and have not yet met any of the executives 
from SIBL. Based on my discussion with Shohid, however, I can see no reason why we should not continue the 
relationship as at present." 4/16/2005 email from HSBC Steve Banner, HSBC PSI PROD 0102765. See also 
Subcommittee briefing by HSBC legal counsel (4/12/2012). 

1390 See 8/3/2006 press release, "Treasury Designates Director, Branches of Charity Bankrolling Al Qaida Network," 
U.S. Treasury Department, reprinted in 8/3/2006 email from HBUS Sharyn Malone to HBUS Stephanie Napier and 
others, "Social Investment Bank, Bangladesh," HSBC OCC 3259936. 

1391 8/3/2006 press release, "Treasury Designates Director, Branches of Charity Bankrolling Al Qaida Network," 
U.S. Treasury Department, reprinted at HSBC OCC 3259936. 

1392 8/3/2006 email from HBUS Sharyn Malone to HBUS colleagues, HSBC-PSI-PROD-0102776 ("IIRO holds a 
8.62% stake in Social Investment Bank (SIB), Bangladesh who is a US PCM client of HBUS since Oct. 2003. Their 
value to US PCM is $44K annualized."). 

1393 See 8/4/2006 FIG Report of Findings (Update) on Social Investment Bank Limited, OCC-PSI-00823818- at 12. 

1394 Id. at 3. 

1395 8/6/2006 email from HBAP Muhammad Shohiduzzaman to HBAP Steve Banner,"Social Invst Bank 
Bangladesh," HSBC OCC 3260411-412. 
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to the HSBC CEO in charge of the operations in Bangladesh, Steven Banner, that Social Islami 
Bank had told him that IIRO "never took part in any activities" at the bank, "did not even take 
possession of the shares," and had never been a board member. 1396 Mr. Shohiduzzaman advised: 
"we are of the opinion that since IIRO is not involved in the operation of SIBL [Social Islami 
Bank Ltd.], there [are] no issues of concern locally. But since the matter has been raised by the 
US treasury, HBUS should take appropriate measure after careful examination of all the present 
and potential aspects." 1397 Mr. Banner wrote to Hersel Mehani, the HSBC sales person assigned 
to the account: "Based on the feedback from SIBL, IIRO's role remains that of a minority 
shareholder that does not seek to engage in the management of the bank. We have no reason to 
disbelieve SIBL's statements. There are therefore no grounds for me to recommend an account 
closure or account freeze." 1398 



Mr. Banner continued: 



"I appreciate, however, that HBUS may feel compelled to act firmly in the light of 
OFAC's position. This is obviously a decision that rests with HBUS and I can 
confirm that we will not object to such action. That said, we would much prefer it 
if SIBL is allowed to withdraw the balances held with HBUS before you freeze or 
close the account. From our perspective there appears to be no justification for 
depriving SIBL of their funds and to do so would open HSBC to unwanted 
reputational damage / regulatory scrutiny locally." 1399 

In essence, Mr. Banner asked for the account to be kept open but if it were frozen, to allow 
Social Islami Bank to pull its money first so that none of its funds would be affected. 

Later that same day, August 6, 2006, HBUS AML Compliance officer Alan Ketley 
forwarded the email exchange to his AML Compliance colleagues, George Tsugranes and 
Andrew Rizkalla, and asked for their thoughts. 1 00 Both advised closing the account. Mr. 
Tsugranes wrote: 

"Although the Philippine and Indonesia branch offices were cited, the Treasury 
action also cited Abd Al Hamid Sulaiman Al-Mujil who is a high ranking IIRO 
official. So although only the 2 branches were cited, having a top official in the 
organization mentioned should be cause for concern involving the IIRO. As this 
organization has a 9.0% stake and does not involve itself on the day to day 
operations or mgmt - who is to say that they won't sooner or later or start moving 
funds through this acct." 1401 



1397 Id. 

1398 8/6/2006 email from HBAP Steve Banner to HBAP Muhammad Shohiduzzaman, "Social Invst Bank 
Bangladesh," HSBC OCC 3260411. 

1399 Id. See also 8/6/2006 email from HBAP Hersel Mehani to HBUS Alan Ketley, HSBC OCC 3260410. 

1400 3/7/20O6 email exchange among HBUS Alan Ketley, George Tsugranes, and Andrew Rizkalla, "Social Invest 
Bank Bangladesh," HSBC OCC 3260409-410. 
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Mr. Rizkalla wrote: 

"I remain firm to my first opinion, the account should be closed in an orderly 
fashion. We still don't know if there is a nominee shareholder interest to IIRO, 
the U.S. Govt has designated IIRO for supporting terrorism, so even the small 
shareholder ownership entitles them to profits and dividends from Soc Invst Bank 

to reinvest where?? Hersel says monitor the accounts for 6 months, will he 

be doing the monitoring??" 1402 

Despite their advice to close the account, Mr. Ketley lifted the block on the account four 
days after it was imposed and approved keeping the account open: 

"After reviewing the information provided by HSBC Dhaka my provisional 
decision is that this relationship be allowed to continue. It will need to be 
designated as an SCC Category 4 (reputational risk) with immediate effect and 
will be subject to closer monitoring as a result .... I am not willing to commit to 
the 6 months suggested by Hersel and we will review activity and determine what 
further action may be required as events warrant. . . . IIRO's shareholding is a 
minority holding and information received indicates that they exert neither 
management control nor have board representation. While this entity clearly 
represents a heightened reputational risk to the bank, I believe that with the 
knowledge we have today and the controls that are being implemented we have 
mitigated that risk adequately." 1403 

A few days later, FIG forwarded its report on Social Islami Bank to the head of HBUS 
AML Compliance, Teresa Pesce. She wrote to Mr. Ketley: "This makes me very 
uncomfortable. Can we talk to the business about this?" 1404 Despite the discomfort she 
expressed and the advice of two AML compliance officers, the account was kept open. Mr. 
Ketley reported to the Subcommittee that he understood that IIRO was a passive shareholder, 
that Social Islami was attempting to expel them, and that he talked about the account with Terri 
Pesce and Denise Reilly and believed they supported his decision to maintain the account. 1405 
Ms. Pesce told the Subcommittee that she did not recall much about the relationship, but the 
bank should have reached out to OFAC with regard to it. 1406 HBUS OFAC Compliance officer 
Elizabeth Protomasto told the Subcommittee that she contacted OFAC about this relationship 
after the SDN designation, and was told that the bank could continue to do business with Social 
Islami Bank, because only two branches of the IIRO had been designated by OFAC as SDNs, not 



1402 Id. 

1403 8/7/2006 email from HBUS Alan Ketley to Hersel Mehani and others, "Social Investment Bank," HSBC OCC 
3260426. 

1404 8/1 1/2006 email from HBUS Teresa Pesce to Alan Ketley and Andrew Rizkalla, "Re: Report of Findings - 



Social Investment Bank Limited - Bangladesh - FIG," HSBC OCC 3261519. 

1405 Subcommittee interview of Alan Ketley (2/16/2012). 

1406 Subcommittee interview of Teresa Pesce (3/30/2012). 
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all branches and not the branch in Bangladesh. 1407 Social Islami Bank was also designated an 
SCC client. 1408 

IIRO Remained a Shareholder for Six Years. In September 2006, Mr. Ketley asked 
Mr. Mehani to obtain additional information from the Social Islami Bank about its relationship 
with IIRO. In response to a question asking whether IIRO was "a customer of the bank," Mr. 
Mehani wrote that the bank had told him: "IIRO has no relationship with the subject bank and 
do[es] not maintain or operate any account with the bank." 1410 In 2009, however, an internal 
FIG due diligence report quoted a 2008 local press article stating that the IIRO did have an 
account at Social Islami Bank, as well as over 50,000 bank shares which FIG estimated might 
then be worth $733,000. 1411 In 2010, the HBUS KYC profile referenced a Bangladeshi Central 
Bank letter dated June 30, 2010, stating that IIRO had accounts at three Bangladeshi banks, 
including Social Islami Bank, that needed to be closed. 1412 Social Islami Bank told the 
Subcommittee that IIRO did have a "foreign currency account" with the bank that was opened in 
1995, but has a current balance of zero. 1413 

In 2006, Mr. Mehani indicated that the bank planned to "oust" IIRO as a 
shareholder at its next board of directors meeting and sell IIRO's bank shares. 1414 Mr. 
Mehani wrote: "IIRO never responded to their request to provide a full address rather 
than a PO box and they will use this to oust them by November [2006] which is allowed 
according to their Articles of Association which I have a copy given by them to me." 1415 
Despite that communication, a 2006 Social Islami Bank board resolution authorizing sale 
of the shares, 1416 and HBUS' repeated inquiries into their status over multiple years, 1417 



1407 Subcommittee interview of Elizabeth Protomastro (6/9/2012). 

1408 See 2012 HBUS KYC Profile of Social Islami Bank at 14 (applying SCC designation as of 8/7/2006). 

1409 9/19/2006 

1410 9/27/2006 email from HBUS Hersel Mehani to HBUS Alan Ketley and others, "Compliance issues from Trip 
Dhaka," HSBC-PSI-PROD-0102755-756 (answer to Question 5). 

1411 5/5/2009 Financial Intelligence Unit Report of Findings on Social Investment Bank Limited, OCC-PSI- 
00823818, at 7 (quoting 10/8/2008 article from Bangladeshnews.com). The FIG report also stated: "You may 
therefore wish to obtain information from your customer to ascertain the status of the accounts held by the IIRO in 
the Social Investment Bank Ltd. You may also wish to consider the risks, including reputational risk involved in 
maintaining this account relationship." Id. at 7-8 (emphasis omitted). 

1412 2012 HBUS KYC Profile of Social Islami Bank at 4 ("The 3 bank accounts of IIRO namely i) Social Islami 
Bank Ltd. ii) Islami Bank Bangladesh Ltd. iii) Al-Falah Islami Bank Ltd. must be disposed off [sic] and 
transferred"). 

1413 7/1 1/2012 Social Islami Bank response to Subcommittee questions, at 4, PSI-SIBL-0 1-001. 

1414 9/27/2006 email from HBUS Hersel Mehani to HBUS Alan Ketley and others, "Compliance issues from Trip 
Dhaka," HSBC-PSI-PROD-0102755-756. 

1415 Id. See also 2012 HBUS KYC Profile of Social Islami Bank at 5 ("Compliance advised ... that IIRO has no 
involvement in the running of the bank, is not a client of the bank and will likely be ousted as a shareholder [which] 
give considerable grounds for comfort"). 

1416 See 12/14/2006 letter from Social Islami Bank quoting board resolution, HSBC OCC 3342182. 

1417 See, e.g., January 2007 email exchange among HBUS Muhammad Shohiduzzaman, Hersel Mehani, Alan Ketley 
and others, "Social Investment Bank - IIRO," OCC-PSI-00808829; 9/23/2008 email exchange among HBUS Alan 
Williamson, Daniel Jack , Hersel Mahani, and others, "Social Investment Bank," OCC-PSI-00246337; 9/23/2008 
email exchange among HBUS Alan Williamson, Daniel Jack, Gloria Strazza, Monique Codjoe, and others, 
"POSITIVE OFAC MATCH - IIRO -KYC NOTES DATABASE," OCC-PSI-00246334; 9/24/2008 call report 
from a meeting at Social Islami Bank, HSBC-PSI-PROD-0102615; 3/8/2009 letter from Social Islami Bank to 
HSBC Dhaka, "Information regarding Bank's ownership for KYC purposes," HSBC-PSI-PROD-0102743, at 1; 
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IIRO has remained a shareholder of Social Islami Bank, although its ownership interest 
has gradually dropped from 8.62% in 2006, to 3.85% in 2009, to 1.69% by 2010. 1418 
IIRO currently holds a 1.61% interest in the bank, six years after Social Islami Bank 
promised to ensure the shares would be sold. 1419 

In 2009, Social Islami Bank sent a letter to HBUS indicating that it was planning 
to seek permission from the country's High Court to sell the shares still held by IIRO. 142 
In 2010, Social Islami Bank informed HBUS that the Bangladesh Government had 
reached an agreement with IIRO that, after certain safeguards were put in place, would 
allow IIRO to begin operating in the country again. 1421 One of the conditions was that 

1422 

the IIRO would have to "dispose" of its Social Islami Bank account, although that 
account remains open today with a zero balance. 1423 Social Islami Bank informed the 
Subcommittee that, due to the government's actions, "the bank is under definite 
obligation in paying dividend/issuing bonus shares/right shares to IIRO as per the 
instructions of the Central Bank and Ministry of Finance which were not paid/issued in 
their favor till 3 1/05/2010." 1424 



A Second Terrorist Financier Shareholder. Also in 2009, a due diligence report issued 
by the HBUS Financial Intelligence Group identified a second, longterm Social Islami Bank 
shareholder that raised concerns. It disclosed that Islamic Charitable Society Lajnat al-Birr Al 
Islam still held a 1.54% ownership interest in the bank. 1425 The 2009 FIG report explained that 
World Check, the database relied on by HSBC for KYC purposes, had classified the charity "as a 
terrorist organization with reported tie[s] to Hamas. In September 2008, the Israeli government 
reportedly declared it an illegal entity." 1426 Despite this new information in the 2009 FIG report, 
the HBUS KYC profile on Social Islami Bank does not acknowledge it, stating instead in a note: 
"Updated EDD [Enhanced Due Diligence] ROF [Report on Findings] received May 5, 2009. 
Report provided no new, or, up to date information." 1427 Social Islami Bank has informed the 



2/9/2010 email from HBUS Jon K. Jones to HBAP Sadique Reza and others, "Compliance Conditions: Social Islami 
Bank Ltd," HSBC-PSI-PROD-0102737. 

1418 See 2012 HBUS KYC Profile of Social Islami Bank at 3-4; 3/8/2009 letter from Social Islami Bank to HSBC 
Dhaka, "Information regarding Bank's ownership for KYC purposes," HSBC-PSI-PROD-0102743, at 1. 

1419 7/11/2012 Social Islami Bank response to Subcommittee questions, at 3, PSI-SIBL-0 1-001; See also 2012 
HBUS KYC Profile of Social Islami Bank at 3, 16. 

1420 3/8/2009 letter from Social Islami Bank to HSBC Dhaka, "Information regarding Bank's ownership for KYC 
purposes," need bates, at 1. Around the same time in 2009, HSBC's Commercial and Institutional Banking in the 
Asia Pacific region further expanded HSBC's relationship with Social Islami Bank by providing it with new 
commercial banking services. The approval form mistakenly characterized Social Islami Bank as "medium risk," 
erroneously said it was not an SCC designated client, and stated that none of the bank's disclosed shareholders 
increased the client's risk profile, despite a specific reference to IIRO. 3/10/2009 CIBM-Institutional Banking KYC 
Profile for Social Islami Bank Limited, HSBC-PSI-PROD-0 102646. 

1421 2012 HBUS KYC Profile of Social Islami Bank at 4. 

1422 Id. 

1423 7/1 1/2012 Social Islami Bank response to Subcommittee questions, at 2, PSI-SIBL-0 1-001. 

1424 Id. at 3. 

1425 5/5/ 2009 FIG report, HSBC PSI PROD 0102696 at 3, 5. 

1426 Id. at 5 (emphasis in original is omitted). 

1427 2012 HBUS KYC Profile of Social Islami Bank at 4. 
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Subcommittee that Lajnat al-Birr remains a 0.22% share owner, but does not have any account at 
the bank. 1428 

Sobhan Misconduct. The ongoing ownership of the bank's shares by IIRO and Lajnat 
al-Birr was not the only troubling development. Social Islami Bank's initial Chairman of the 
Board, Ahmed Akbar Sobhan, also known as Shah Alam, was a well-known businessman who 
held, with his son, a 3.35% ownership interest in the bank since its inception. 1429 Beginning in 
2006, however, Mr. Sobhan and his son became the subjects of several criminal investigations 
involving bribery, corruption, fraud, and tax evasion. 1430 In 2007, Mr. Sobhan and his son 
reportedly fled to the United Kingdom, after which Mr. Sobhan was the subject of corruption 
charges brought in his absence by the Bangladeshi Anti-Corruption Commission which 
sentenced him to eight years in prison. 1431 This troubling information was detailed in the 2009 
FIG report that was later described in the Social Islami KYC profile as containing no new 
information. 1432 

In May 2012, HSBC terminated its relationship with Social Islami Bank. 1433 David 
Bagley, head of HSBC Group Compliance, told the Subcommittee, when asked, that the closure 
decision had been a "no brainer." 14 4 He did not explain what factors led to the termination 
decision. Social Islami Bank currently has no open account with any HSBC affiliate. 1435 

J. Analysis 

HSBC is a global bank with a strong presence in many countries confronting 
terrorist threats. If safeguards are lacking, HBUS offers a gateway for terrorists to gain 
access to U.S. dollars and the U.S. financial system. HSBC has a legal obligation to take 
reasonable steps to ensure it is not dealing with banks that may have links to or facilitate 
terrorist financing. 

Banks rarely carry explicit links to terrorist financing, but in the three banks 
reviewed here, an array of factors raised troubling questions. In the case of Al Rajhi 
Bank, the factors included the naming of a key bank official in a list of al Qaeda 
financial benefactors, a U.S. law enforcement search of Al Rajhi nonprofit and business 
ventures in the United States to disrupt terrorist financing, a CIA report targeting the 



7/11/2012 Social Islami Bank response to Subcommittee questions, at 2, PSI-SIBL-0 1-001. 



1428 

1429 See "Social Investment Bank Ltd. Director's Business Information," Social Islami Bank, undated, HSBC-PSI- 
PROD-0102626; 2003 Bankers Almanac at 3891 (listing Mr. Sobhan with a 2.12% interest and Mr. Sobhan and his 
son, Sadat Sobhan, sharing a 1.23% interest). 

1430 See 5/5/2009 Financial Intelligence Unit Report of Findings on Social Investment Bank Limited, HSBC OCC 
3261530, at 6-7. See also "Court orders to arrest Bashundhara chairman," The Daily Star (4/26/2012), 
http://www.thedailystar.net/newDesign/news-details.php?nid=231738; "Shah Alam lands in jail," The Daily Star 
(3/21/201 1), http://www. thedailystar.net/newDesign/news-details. php?nid= 178563. 

1431 See 5/5/2009 Financial Intelligence Unit Report of Findings on Social Investment Bank Limited, HSBC OCC 
3261530, at 6-7. 

1432 5/5/2009 Financial Intelligence Unit Report of Findings on Social Investment Bank Limited, HSBC OCC 
3261530, at 2, 6-7; 2012 HBUS KYC Profile of Social Islami Bank at 4. 

1433 7/1 1/2012 Social Islami Bank response to Subcommittee questions, PSI-SIBL-0 1-001, at 2. 

1434 Subcommittee interview of David Bagley (5/10/2012). 

1435 7/1 1/2012 Social Islami Bank response to Subcommittee questions, PSI-SIBL-01-001, at 2. 
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bank for being a "conduit" for extremist finance, the bank's refusal to produce 
authenticating bank documents for use in the criminal trial of a client who cashed 
travelers cheques at the bank for use by terrorists, and multiple accounts held by suspect 
clients. In the case of Islami Bank, the factors included substantial ownership of the bank 
by al Rajhi interests, Central Bank fines for failing to report suspicious transactions by 
militants, and an account provided to a terrorist organization. In the case of Social Islami 
Bank, the factors included ownership stakes held by two terrorist organizations whose 
shares were exposed but never sold as promised, and a bank chairman found to be 
involved with criminal wrongdoing. 

In each case, HBUS and HSBC personnel were aware of the information, but 
approved or maintained the accounts anyway. When an AML Compliance officer like 
Beth Fisher declined to approve an account, HSBC personnel found someone else to take 
her place. In several cases, Christopher Lok, head of U.S. Banknotes, took on the role of 
relationship manager fighting for account approval. His test for taking on that role 
depended in part upon how much revenue an account would produce. Al Rajhi Bank's 
threat to terminate business with HSBC affiliates also appears to have galvanized HBUS' 
renewal of the account. 

Another striking feature of these accounts is the fact that a decision by one HSBC 
affiliate to terminate a relationship with a bank due to terrorist financing concerns did not 
always lead other HSBC affiliates to follow suit. In the case of Al Rajhi Bank, for 
example, HBUS terminated the relationship, but HSBC affiliates in the Middle East 
continued to do business with the bank. One HBUS executive later argued that, since 
HSBC was already exposed to the reputational risk posed by Al Rajhi Bank through the 
accounts at other HSBC affiliates, its reputational risk would not increase if one more 
account were opened. In May 2012, HSBC changed its policy to apply decisions to 
terminate a client relationship to apply globally to all its affiliates. 



241 



VI. HOKURIKU BANK: CLEARING BULK TRAVELERS CHEQUES 

With few questions asked and despite ongoing evidence of suspicious activity, HBUS 
cleared tens of millions of dollars per year in bulk travelers cheques for Hokuriku Bank of Japan. 
According to Hokuriku Bank, from 2005 to October 2008, HBUS cleared travelers cheques 
totaling between $70 million and $90 million per year for the bank, producing a grand total in 
less than four years of more than $290 million. HBUS estimated that, at one point in 2008, it 
was clearing travelers cheques for the bank at an average of $500,000 to $600,000 per day. The 
Hokuriku deposits consisted of U.S. dollar travelers cheques that were in denominations of $500 
or $1,000, came in batches of sequentially numbered cheques, and were signed and counter- 
signed by the same person using an illegible signature. They were made payable to one of 30 
different companies or individuals, all of whom claimed to be in the used car business. The 
cheque beneficiaries were clients of Hokuriku Bank, but the cheques were purchased from the 
same Russian bank for deposit into their accounts in Japan. When HBUS finally asked Hokuriku 
Bank about those clients and the business purpose behind Russians cashing massive numbers of 
U.S. dollar travelers cheques on a daily basis for deposit in Japan, Hokuriku Bank claimed to 
have little or no KYC information or understanding of its clients' banking transactions. 

The documents produced to the Subcommittee disclosed that some HBUS AML 
Compliance personnel raised concerns about the Hokuriku travelers cheques in 2005, but failed 
to investigate the transactions. The Hokuriku travelers checks came to HBUS' attention again in 
2007, during the course of an OCC AML examination which found "serious concerns related to 
weak policies, procedures, systems and controls" with how it processed monetary 
instruments, 143 but HBUS again failed to investigate the transactions. In 2008, during a 
followup OCC AML examination, the OCC singled out the Hokuriku travelers cheques as 
suspicious and required HBUS to obtain additional information about them. 

The OCC and HBUS quickly uncovered troubling information about the travelers 
cheques, including that they had originated in Russia, a country at high risk of money laundering, 
involved millions of U.S. dollars, and had no clear business purpose. When HBUS sought more 
information about the cheques, Hokuriku Bank at first delayed responding, then provided 
minimal information, and finally declined to investigate further, claiming to be constrained by 
bank secrecy laws from disclosing client- specific information. In 2008, at the urging of the 
OCC, HBUS stopped accepting travelers cheques from the bank and told the OCC that it planned 
to close the Hokuriku account within 30 days. HBUS later decided to continue to do business 
with Hokuriku Bank in other areas despite its poor AML efforts. In 2010, during the course of 
another AML examination, the OCC uncovered the ongoing relationship with Hokuriku Bank. 
In May 2012, HBUS closed the Hokuriku Bank account, although Hokuriku Bank continues to 
do business with other HSBC affiliates. 



3/3 1/2007 OCC Report of Examination for HSBC bank, OCC-PSI-00304077. [Sealed Exhibit.] 
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A. Hokuriku Bank 

Hokuriku Bank Ltd. is a Japanese regional bank with over 2,800 employees and 185 
branches. 1437 It also has representative offices in New York, London, Singapore, and China. 1438 
Hokuriku Bank traces its origins back to 1877; in 1961, it began trading on the Tokyo Stock 
Exchange. 1439 In 2003, the Hokugin Financial Group was formed in Japan, and Hokuriku Bank 
became a wholly-owned subsidiary of the Group. In 2004, the Group merged with another 
financial institution and changed its name to Hokuhoku Financial Group Inc. which continues to 
operate as the bank's holding company today. 1440 Hokuhoku Financial Group is headed by 
Shigeo Takagi, who has been the President of both the Group and Hokuriku Bank since 2003. 1441 

According to a 2010 HBUS Know Your Customer ("KYC") Profile, Hokuriku Bank is a 
longstanding customer of HBUS, which has provided it with correspondent banking services in 
Hong Kong, Korea, and the United Kingdom, as well as the United States. 1442 In addition to 
HBUS, Hokuriku Bank has correspondent relationships with several other HSBC affiliates as 
well, including Hong Kong and Shanghai Banking Corporation, Ltd. and HSBC Middle East. 1443 
By 2001, Hokuriku Bank had become a client of HBUS' Payments and Cash Management 
(PCM) division which used its processing centers in New York to handle most Hokuriku 

1444 

transactions. 

HBUS provided Hokuriku Bank with two accounts, numbered 50385 and 34738. 
Account No. 50385 was closed on Feb. 6, 2009, and its balance transferred to Account No. 
34738, which remained open until May 2012. 1445 HBUS provided Hokuriku Bank with access to 
U.S. dollars, primarily by clearing millions of dollars in U.S. dollar travelers checks each year. 
According to Hokuriku Bank, HBUS cleared travelers cheques totaling about $77 million in 
2005, $72 million in 2006, $90 million in 2007, and $52 million in 2008, until HBUS stopped 
providing clearing services for the bank's bulk travelers cheques. 1446 Those figures show that, in 
less than four years, HBUS cleared travelers cheques for Hokuriku Bank totaling over $290 
million. HBUS also processed wire transfers from Hokuriku Bank and provided other banking 



143/ See HBUS "Know Your Customer Profile" for Hokuriku Bank (hereinafter "HBUS KYC Profile")(last updated 
on 9/3/2010), prepared by HBUS Global Payments and Cash Management division, HSBC-PSI-PROD-0102415- 
425, at 0102417; "Hokuhoku Financial Group Inc. Annual Report 201 1," (year ended March 31, 2011)(hereinafter 
"Hokuhoku 201 1 Annual Report"), at 59, http://www.hokuhoku-fg.co.jp/english/financial/docs/fg_ar201 l.pdf. 

1438 Hokuhoku 201 1 Annual Report at 1, 59. 

1439 See Hokuhoku 201 1 Annual Report at 59; HBUS KYC Profile at HSBC-PSI-PROD-0102416. 

1440 See Hokuhoku 201 1 Annual Report at 59; HBUS KYC Profile at HSBC-PSI-PROD-0102416. 

1441 HBUS KYC Profile at HSBC-PSI-PROD-0 102420; Hokuhoku 201 1 Annual Report at 61. 

1442 HBUS KYC Profile at HSBC-PSI-PROD-0102417-418. HBUS told the OCC that it first opened an account for 
Hokuriku Bank in 1978, through its U.S. predecessor, Marine Midland Bank, which HSBC purchased during the 
1980s. 5/15/2012 email from OCC to the Subcommittee, "HSBC - Hokuriku Questions," PSI-OCC-38-0001-002. 

1443 See 6/26/2012 letter from Hokuriku Bank's legal counsel to the Subcommittee, at 1, PSI-HokurikuBank-01- 
0001. 

1444 HBUS KYC Profile at HSBC-PSI-PROD-0 102423. 

1445 Id. at HSBC-PSI-PROD-0102420. HBUS closed the second account on May 21, 2012. 6/26/2012 letter from 
Hokuriku Bank's legal counsel to the Subcommittee, at 1, PSI-HokurikuBank-01-0001. 

1446 See 6/26/2012 letter from Hokuriku Bank's legal counsel to the Subcommittee, chart entitled, "Volume of U.S. 
Dollar Travelers Checks to HBUS for Clearance by year," PSI-HokurikuBank-01-0001. Hokuriku Bank cleared 
another $52 million in 2008, until HBUS stopped clearing the cheques in October 2008. 
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services. In 2007, the Hokuriku account produced revenues for HBUS totaling about 
$47,000. 1447 

According to the HBUS KYC Profile, the initial HBUS Account Manager for Hokuriku 
Bank was Nanayo Ryan, and the Relationship Manager for KYC approval purposes was Beth 
Fisher. 1448 In 2008, the HBUS Account Manager switched to Kgomotso Hargraves, while the 
Relationship Manager for KYC approval purposes switched to Wayne W. Ferguson, then 
Anthony Julian, then Wen Lu Wu. 1449 The Global Relationship Manager since 2008 has been 
Machiko Yamashita. 1450 



B. Travelers Cheques 



Travelers cheques are typically sent by one financial institution to another via a "pouch." 
A pouch is an envelope or package, and pouch activity refers to the sending or receipt and 
processing of an item that is sent to a bank from another country by common carrier, courier, or 
referral agent. Pouches typically contain currency or a monetary instrument, such as a travelers 
cheque, cashiers cheque, or money order, which is intended to be used to make a deposit or loan 
payment, or to engage in another transaction. Pouches can be sent by an unrelated financial 
institution, a bank affiliate, or by an entity or individual. 

In addition to physical delivery of monetary instruments, many banks, including HBUS, 
provide a service called "Remote Deposit Capture" (RDC). RDC enables customers who sign up 
for the service to send electronic images of physical monetary instruments that they wish to 
present for deposit, including travelers cheques. Processing these electronically sent deposits are 
sometimes referred to as part of the receiving bank's pouch activity. 

At large banks, pouched monetary instruments are typically sent to a specialized facility 
for processing. These facilities typically process a high volume of monetary instruments on a 
daily basis. When a bank processes a pouched travelers cheque, it typically credits the amount of 
the cheque to the correspondent account of the client financial institution that sent the cheque. 
Pouch activity is often referred to as "cash letter" activity, since it consists primarily of cashing a 
monetary instrument by crediting an account with the amount specified on the instrument. 
Providing cash in exchange for a monetary instrument is also referred to as "clearing" the 
instrument. 



HBUS has two processing centers in the United States, one in Brooklyn and one in 
Buffalo, New York, both of which process a high volume of monetary instruments on a daily 
basis. RDC services are provided solely at the Buffalo center. 1451 Both centers segregate 
travelers cheques from other types of deposits and process them separately, crediting the U.S. 



144/ HBUS KYC Profile at HSBC-PSI-PROD-0 102420. 

1448 Id. at 0102424. 

1449 Id. at 0102418, 424-425. 

1450 9/5/2008 email from Hideki Matsumoto to Michio Yamashita and others, "Hokuriku Bank," OCC-PSI- 
00808695, at 5. 

1451 10/4/2010 draft OCC Supervisory Letter to HBUS, OCC-PSI-00863984-992, at 2. [Sealed Exhibit.] 
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dollars to the relevant client accounts. A processing clerk typically skims each deposit to 
identify any sequentially numbered travelers cheques. If the sequentially numbered cheques 
total more than a designated amount, the clerk is required to refer the deposit to HBUS AML 
Compliance for approval prior to processing. 1453 If the sequentially numbered travelers cheques 
exceed another specified threshold, the processing clerk must attach a Traveler's Cheque/Money 
Order High Value Deposit Information (TC/MO HVDI) form to the deposit prior to 
processing. 1454 If the form is not attached, the deposit must be submitted to AML Compliance 
for approval prior to processing. 1455 This procedure is intended to ensure that HBUS AML 
Compliance is kept apprised of large deposits of sequentially numbered travelers cheques, since 
such cheques are often associated with money laundering or other misconduct. 

U.S. banking regulators have long warned financial institutions about the money 
laundering risks associated with travelers cheques which can be purchased with cash by a non- 
customer of the bank and used to move substantial funds across international borders in ways 
that are difficult to trace. 1456 Travelers cheques have been used by terrorists, 1457 drug 
traffickers, 1458 and other criminals. 1459 



1452 6/26/2008 Memorandum to the OCC Examiner-In-Charge Anthony DiLorenzo from OCC Examiner Elsa de la 
Garza, "Pouch Transactions - Hokuriku Bank and SK Trading Company Ltd," OCC-PSI-00885828, at 1. [Sealed 
Exhibit.] 

1453 Id. 

1454 Id. 

1455 Id. 

1456 See, e.g., Federal Financial Institutions Examination Council (FFIEC) Bank Secrecy Act/ Anti -Money 
Laundering (BSA/AML) Examination Manual, "Core Overview: Purchase and Sale of Monetary Instruments," 
(6/23/2005) at 59; FFIEC BSA/AML Examination Manual, "Purchase and Sale of Monetary Instruments- 
Overview," (8/24/2007) at 212 ("The purchase or exchange of monetary instruments at the placement and layering 
stages of money laundering can conceal the source of illicit proceeds. As a result, banks have been major targets in 
laundering operations because they provide and process monetary instruments through deposits."). 

1457 See, e.g., United States v. al-Haramain Islamic Foundation Inc. , Case No. 6:05-cr-60008-HO (USDC Oregon) 
Indictment (2/17/2005); "Former U.S. Head of Al-Haramain Islamic Foundation Sentenced to 33 Months in Federal 
Prison," U.S. Attorney's Office for the District of Oregon press release (9/27/1 1) at 1 (describing how the convicted 
defendant cashed $130,000 in U.S. dollar travelers cheques at a bank in Saudi Arabia and then provided the funds to 
support violent extremists in Chechnya). 

1458 See, e.g., United States v. Wachovia Bank N.A. , Case No. 10-201 65 -CR-Lenard (USDC SDFL), Factual 
Statement, Exhibit A to Deferred Prosecution Agreement (3/16/2010), at % 35 (describing how Wachovia Bank 
processed $20 billion in suspicious travelers cheques, some portion of which was suspected to include illegal drug 
proceeds); "How a Big U.S. Bank Laundered Billions from Mexico's Murderous Drug Gangs," The Guardian , 
(4/2/2011), http://www.guardian.co.uk/world/2011/apr/03/us-bank-mexico-drug-gangs. See also Albajon v. 
Gugliotta , 72 F. Supp. 2d 1362, 1365 (S.D. Fla. 1999) (admitting travelers cheques as evidence of drug trafficking 
proceeds); United States v. $41,305.00 in Currency & Travelers Checks , 802 F.2d 1339, 1343 (11th Cir. 1986) 
(finding travelers cheques could be seized as drug trafficking proceeds). 

1459 See, e.g. Folk v. State , 192 So. 2d 44, 46 (Fla. Dist. Ct. App. 1966) (upholding conviction for signing a false 
name on travelers cheques and cashing them); United States v. Sebaggala , 256 F.3d 59, 63 (1st Cir. 2001) 
(upholding conviction for using undeclared travelers cheques to attempt to move money fraudulently through U.S. 
customs). 
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C. 2005 Concerns about Hokuriku Travelers Cheques 

The documents produced to the Subcommittee show that HBUS AML Compliance 
personnel were aware of, and expressed concerns about, the large number of travelers cheques 
being cashed for Hokuriku Bank from at least as early as March 2005, but did little about them 
for years. 

On March 15, 2005, HBUS AML compliance officer George Tsugranes sent an email to 
the HBUS account manager for Hokuriku Bank, Nanayo Ryan, in which he noted that, in less 
than 60 days from January to March 2005, Hokuriku Bank had deposited travelers cheques 
totaling over $2 million. 1460 The email provided a chart listing 41 separate deposits over a 5 1- 
day period, showing that the deposited amounts ranged from $20,000 to $100,000 at a time; 
often consisted of multiple $1,000 travelers cheques; and referenced about ten different clients, 
including corporations and individuals. 1461 All of the deposits were to Hokuriku Bank's Account 
No. 50385. Mr. Tsugranes asked Mr. Ryan: 

"to reach out to the bank and ask that adequate KYC is on file for each name listed on 
the spreadsheet, whether the customer activity is consistent with the KYC, and also who 
is their customer base (local clients, people buying cars for export, etc.) and why US 
dollar travelers checks would be used for payment." 1462 

This email shows that, in early 2005, Hokuriku' s pattern of making large deposits with multiple 
travelers cheques triggered a review by HBUS AML Compliance personnel concerned about 
who was behind the deposits. Despite the request for more information in the March 2005 email, 
the Subcommittee received no additional documentation or information indicating that HBUS 
AML Compliance personnel actually sought or obtained additional KYC information from 
Hokuriku Bank in early 2005, regarding the travelers cheques it was cashing. 

Eight months later, in November 2005, several emails indicate that HBUS AML 
Compliance personnel took a broader look at the cash letter/pouch activity at its Brooklyn center, 
apparently in an effort to detect unlicensed money service business activity. 1463 This inquiry was 
not specific to Hokuriku Bank. On Nov. 23, 2005, HBUS AML senior compliance officer Alan 
Ketley sent an email to AML compliance officer Mark Balawender stating that, while HBUS had 
"strong monitoring procedures in place for PCM clients," he wasn't sure about what was "in 
place for other clients" at the Brooklyn center. He attached to the email a 21 -page chart listing 
the "cash letter volume" for 35 bank clients over a one-year period from April 2004 to March 



14< *' 3/15/2005 email from HBUS George Tsugranes to HBUS Nanayo Ryan, "Hokuriku Bank C/L Activity," HSBC 
OCC 31 13976-977. The chart is unlikely to contain a comprehensive list of all of the travelers cheques presented 
by Hokuriku Bank over the course of those two months since, during 2005 alone, Hokuriku Bank cleared $77 
million in travelers cheques through HBUS. See 6/26/2012 letter from Hokuriku Bank's legal counsel to the 
Subcommittee, chart entitled, "Volume of U.S. Dollar Travelers Checks to HBUS for Clearance by year," PST 
HokurikuBank-01-0001 . 

1461 Id. at 3113977. 

1462 Id. 

1463 See email exchange among HBUS AML Compliance personnel, from 1 1/23 - 1 1/29/2005, HSBC OCC 
3180772-797, including 3180773 ("I do not believe there are any formal or documented checks in place that would 
identify potential unlicensed money service business activity"). 
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2005. 464 The data disclosed, among other information, that over the course of the year, 
Hokuriku Bank had cashed an increasingly larger volume of monetary instruments each month 
into its Account No. 50385, building from 36 items totaling about $209,000 in April 2004, to 109 
items totaling over $4.3 million in March 2005. Altogether for the year, Hokuriku Bank is 
recorded as having deposited at HBUS 562 "envelopes" with over 24,000 items totaling $11.2 



On November 25, 2005, Mr. Balawender sent an email to Mr. Ketley with his 
findings. 1466 He described the Brooklyn center as engaged in "heads down volume 
process[s]ing." He stated, "Given the volume/deadline driven/processing nature of the 
departments above, I am not sure what we can do. ... I would anticipate a rather strong push- 
back from Ops and the branches, if AML Compliance were to suggest additional processes." 146. 

No further information or inquiries related to Hokuriku Bank appear in the 2005 
timeframe among the documents provided to the Subcommittee in response to a broad request 
for all documents related to Hokuriku Bank and pouch activity. When asked for more 
information about the March and November 2005 reviews, Mr. Ketlev indicated that he could 
not recall either Hokuriku Bank or what happened in either review. 14 8 

In sum, despite a specific March 2005 AML inquiry into $2 million in travelers cheques 
cleared for Hokuriku Bank, and a broader November 2005 inquiry that included evidence of an 
escalating pattern of Hokuriku deposits, HBUS AML Compliance apparently took no further 
action to investigate Hokuriku' s cash letter activities in 2005. The 2005 and 2006 OCC annual 
examination of HBUS also made no mention of AML issues related to its pouch activities or 
clearance of travelers cheques. 1469 



D. 2007 OCC Pouch Examination 



Two years after the internal HBUS inquiries, in early 2007, the OCC commenced an 
AML examination of HBUS' pouch activities. 1470 In response, HBUS AML compliance officer 
George Tsugranes produced a chart listing clients with a high volume of cash letter activity 
during the last two months of 2006. 1471 Hokuriku Bank was repeatedly listed, appearing in the 
chart more times than any other bank. Over a 62-day period, the chart identified 100 Hokuriku 
deposits. The deposit amounts ranged from $20,000 to $193,000 at a time, often consisted of 
multiple $1,000 travelers cheques, and referenced about a dozen clients, both corporate and 



1464 Id. at 3180776-797. 

1465 Id. at 3180776. 

1466 Id. at 3180773. 

1467 Id. 

1468 Subcommittee interview of Alan Ketley (2/16/2012). 

1469 See OCC Reports of Examination of HBUS, for the examination cycle ending March 31, 2005 and March 31, 
2006, need bates. [Sealed Exhibit.] 

1470 See 5/8/2007 OCC Memorandum, "BSA/AML Examination - HSBC, USA, NA - Pouch Activities," OCC-PSI- 
01298647 [Sealed Exhibit.]; 3/2/2007 email from HBUS George Tsugranes to HBUS Alan Ketley, HSBC OCC 
3352026. 

1471 See chart, prepared by HBUS AML Compliance, HSBC OCC 3352034-037. 
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individual. Many of the client names on the 2006 list had also appeared on the March 2005 
list compiled by Mr. Tsugranes. The total amount deposited over the two-month period was 
about $5.6 million. 

Mr. Tsugranes sent the chart to his supervisor, Mr. Ketley, and wrote that "all acc[oun]ts 
are being checked to ensure activity is reflected on KYC." Of the documents produced to the 
Subcommittee, none indicate, however, what information was "checked" with respect to 
Hokuriku Bank or what Mr. Tsugrantes learned. 

Six weeks later, on April 24, 2007, Mr. Ketley asked HBUS AML compliance officers 
Mr. Tsugranes and Robert Guthmuller, to travel to the HBUS Brooklyn center "to gain a 
thorough understanding of what is processed . . . [and] what items are reviewed." 1473 Three days 
later, on April 27, 2007, Mr. Guthmuller sent an email to Mr. Ketley providing him with "the 
Readers Digest version" of their findings after "a high level review of cash letter processing" at 
the Brooklyn center. 1474 

Mr. Guthmuller' s email stated that the Brooklyn center "treat[ed] all clients the same," 
regardless of whether cash letter items involved "high risk clients." He wrote: "We should be 
drilling down on our high risk customers" and, for example, "identify those clients that in the 
past have sent a large number of sequentially numbered travelers checks . . . and monitor 
accordingly." 1475 Mr. Guthmuller also wrote that the center staff had "divided loyalty," 
explaining: 

"Their main job is processing checks - 5:00PM deadline. But they are also asked to be 
the 'front line' for monitoring, referring items to Delaware for further investigation. One 
job focuses on pushing items through, another is to go slower, review items, ask 
themselves questions - is it suspicious? - contact Delaware - wait for a response - 
hopefully before 5:00PM. 

[0]ne solution is to have a full time compliance person review items FULLY, that means 
internet searches, OFAC, wor[l]dcheck etc. Additionally the compliance person could 
drill down on the high risk accounts." 1476 

Mr. Guthmuller also stated that HBUS "[m]ust improve trend analysis. Nothing done in 
Brooklyn." He wrote: 



Hokuriku Bank told the Subcommittee that, since the mid 1980s, it has limited its clients to deposits of no more 
than $1,000 in travelers cheques per person per day, unless the cheques were issued by Hokuriku Bank or the 
depositor was a "regular customer" and the bank "deemed that the funds will be collected from the customer should 
it turn out that the travelers' che[c]k was not duly issued." 6/26/2012 letter from Hokuriku Bank's legal counsel to 
the Subcommittee, at 4, PSI-HokurikuBank-0 1-0001. 

1473 4/23/2007 email from HBUS Alan Ketley to HBUS George Tsugranes, Robert Guthmuller, Mark Balawender, 
and others, "Vist to Brooklyn Ops," OCC-PSI-003 12153, at 5-6. 

1474 4/27/2007 email from HBUS Robert Guthmuller to HBUS Alan Ketley, "Visit to Brooklyn OpsLink," OCC- 
PSI-003 12153, at 4. 

1475 Id. at 5. 

1476 Id. at 5 (emphasis in original). 
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"We have reportedly had all travelers checks $20k and over ... on Excel for 4 years but 
haven't used/sorted items for trend analysis. Let's start looking at it. WHAT ABOUT 
SEQUENTIALLY NUMBERED TRAVELERS CHECKS AGGREGATING SAY 
$15Kperday, same payee ...?" 1477 

This email indicated that HBUS had compiled an extensive database of travelers cheque 
information, but was not using it to identify suspicious travelers cheque activity or high risk 
clients. 



Mr. Guthmuller also wrote that the HBUS AML office in Delaware "must improve" its 
enhanced due diligence (EDD) efforts, including by using "more internet searches, calls on high 
risk clients asking questions, use of certifications, etc." 1478 His email indicated that HBUS' 
AML staff did not engage in sufficient due diligence activity to identify high risk clients 
depositing bulk travelers cheques. 

Mr. Ketley forwarded the email to his supervisor, Anne Liddy, a senior HBUS 
Compliance official, with the comment, "Food for thought." 1479 He wrote: "We will look to 
have a meeting with Bob [Guthmuller] next week to discuss further." 

Ten days later, on May 7, 2007, Mr. Tsugranes sent an email to Mr. Ketley and others 
stating he had "discussed the issues with the Delaware AML team and asked for some input on 
ways to improve our cash letter monitoring." 1480 He stated: "Below are some recommendations 
which will allow for both operational benefits and a more risk based monitoring approach." 

His email advised reducing the monitoring of checks from Fortune 100 names, and 
revising the dollar limit to $100,000 to trigger review of an account of a Special Category Client 
(SCC). While reducing review of Fortune 100 names could be seen as an effort to target AML 
review efforts to higher risk transactions, imposing a $100,000 dollar limit on SCC clients, the 
bank's highest risk clients, set a high bar to trigger a review. With respect to Hokuriku Bank and 
another bank in Korea, Mr. Tsugranes advised that AML personnel track the banks' total daily 
deposits, "eliminate the check by check comparison," and "only investigate if an apparent MIF 
[Monetary Instrument Form] was not included." He wrote: "To summarize we would be 
focusing more on SCC clients, cutting back on some Group reviews in non HRCs [non High 
Risk Clients] and also tracking" a specific bank of concern. 

While the Tsugranes email advocated a stronger focus on SCC clients, it did not address 
Mr. Guthmuller' s suggestion to identify other high risk clients by analyzing the bank's travelers 
cheque data. His email did not, for example, include the Guthmuller suggestion to strengthen 
trend analysis of the cash letter activity at the Brooklyn center by utilizing the four years of 
travelers cheque data already included in Excel spreadsheets. The Tsugranes email also failed to 
include the suggestion, urged in capital letters in the Guthmuller email, to identify and 
investigate clients making deposits of sequentially numbered travelers checks above a specified 



1477 



1479 
1480 



Id. at 5 (emphasis in original). 
; Id. at 5. 
Id. at 4. 
Id. at 2-3. 
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threshold. Instead, the Tsugranes email recommended reducing the monitoring directed toward 
Hokuriku Bank by eliminating the "check by check comparison" that had been routine practice. 
In the end, despite another chart disclosing multi-million-dollar Hokuriku deposits of $1,000 
travelers checks, the final result of HBUS' review was to advocate devoting less rather than more 
attention to the bank. 

The two OCC examiners who conducted the 2007 examination told the Subcommittee 
that they were very concerned about the lack of AML controls over HBUS pouch activity and 
had recommended that the OCC impose a Cease and Desist Order requiring HBUS to revamp 
them. 1481 They later concluded, however, that they were unable to meet the OCC standards 
required for issuing the order. Instead, the OCC examiners designated the lack of AML controls 
over pouch processing as a Matter Requiring Attention (MRA) which was included in the annual 
OCC Report of Examination provided to the HBUS Board of Directors on July 24, 2007. 1482 
The MRA did not, however, explicitly identify the Hokuriku travelers cheques as a problem. 

The OCC uses its annual Reports on Examinations to ensure bank boards are kept 
apprised of serious bank deficiencies requiring action by management. The 2007 Report of 
Examination notified the HBUS Board about the OCC's "serious concerns related to weak 
policies, procedures, systems and controls" related to its pouch activities, and urged immediate 
improvements. 1483 In September 2007, the OCC also issued a Supervisory Letter to HBUS 
which again urged that "policies, procedures, systems, and controls for pouch need strengthening 

, . ,,1484 

and augmenting. 

E. 2008 OCC Inquiry into Hokuriku Travelers Cheques 

Nine months later, in June 2008, the OCC commenced a folio wup AML examination of 
HBUS pouch activity, looking at pouch services in additional business units. 1485 During the 
course of that examination, OCC examiners identified the Hokuriku travelers cheque deposits as 
an activity warranting greater scrutiny. 1486 



1481 See 7/3/2007 OCC memorandum, "BSA/AML Examination - HSBC, USA, NA - Pouch Activities," OCC-PSI- 
0087773 [Sealed Exhibit.]; Subcommittee interviews of Joseph Boss (1/30/2012) and Elsa de la Garza (1/9/2012). 

1482 7/24/2007 OCC Report of Examination of HBUS, for the examination cycle ending March 31, 2007, OCC-PSI- 
00304077, at 1 . [Sealed Exhibit.] The MRA read in full as follows: 

"The bank provides pouch services in a number of business unites. An examination of HSBC pouch 
services resulted in serious concerns related to weak policies, procedures, systems and controls. The 
policies and controls in this area are inferior to BSA/AML controls in other areas of the bank, and remedial 
action is warranted. The absence of comprhesnive policies, procedures and adequate systems and controls 
could potentially subject the bank to undue reputation risk and/or lead to BSA/AML violations. Pouch 
serives facilitate easy movement of funds, and are favored by persons who transfer illgal and terrorist 
funds. Consequently, the Board should ensure that management implements appropriate policies, 
procedures, systems and controls for this activity. The Board should communicate the corrective measures 
to the OCC, and confirm subsequent resolution." 

1483 Id. 

1484 9/13/2007 OCC Supervisory Letter, "Pouch Services and Middle Market at HBUS," OCC-PSI-0000039 1-394. 
[Sealed Exhibit.] 

1485 See 6/26/2008 OCC memorandum, "Pouch Transactions - Hokuriku Bank and SK Trading Company Ltd," 
OCC-PSI-00885822-826. [Sealed Exhibit.] 
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In June 2008, two OCC AML bank examiners visited the HBUS Brooklyn and Buffalo 
processing centers to examine their pouch activity. 1487 One of the examiners told the 
Subcommittee that when they visited the Brooklyn center, they found "stacks and stacks of 
travelers cheques, some signed and countersigned by the same entity." In a memorandum the 
examiner wrote that, at the Brooklyn center, she reviewed a Hokuriku cash letter deposit in the 
amount of $1 10,000, and found it consisted of 220 sequentially numbered travelers cheques, 
each for $500. 1489 She wrote that all of the cheques were signed and countersigned by the same 
individual, whose name was illegible, and all were made payable to SK Trading Company Ltd. 
The TC/MO HVDI form attached to the deposit described SK Trading as a "used car dealer" and 
stated that the travelers cheque funds were to be used for a "business purpose." 1490 The other 
examiner reviewed another Hokuriku deposit for $240,000 and found a similar situation 
involving sequentially numbered $1,000 travelers cheques that had been signed and 
countersigned by the same person as the other deposit and made payable to SK Trading. The 
OCC examiners then contacted the HBUS cash letter department manager who explained that the 
Brooklyn center received three to five Hokuriku deposits daily of travelers cheques which totaled 
between $500,000 and $600,000 each day. 1491 He indicated that travelers cheques were the 
"only types of instruments received through pouch for Hokuriku Bank." 1492 

The OCC examiners researched SK Trading and found that, according to its website, 
the company appeared to be headquartered in Seoul, Korea, with offices in Japan and the United 
States, and had been in business since 1984. 1493 They also found that the company had been 
identified by other financial institutions as involved with suspicious activity. These other 
financial institutions had identified suspicious wire transfers, sometimes involving millions of 
dollars, which were originated by individuals with Russian surnames who sent the funds from 
accounts at Russian banks or which were originated by corporations that sent the funds from 
banks in the British Virgin Islands. 1494 The ultimate beneficiary of the funds in each case was 
SK Trading using accounts at various banks in Japan. The OCC examiners noted that, in 
November 2006, one of the financial institutions had contacted Hokuriku Bank directly and 
asked it about the business purpose behind the transactions, but was told that Hokuriku Bank 
"could not answer this as their customer (S.K. Trading Company Limited) refused to provide 
information." 1495 

The OCC examiners concluded that SK Trading was "conducting high dollar volumes of 
activity utilizing wire transfers and pouch services," that SK Trading was involved with 
"numerous entities," and that the transactions involved "numerous individuals from Russia," and 
warranted additional investigation. 1496 The travelers cheques' connections to Russia raised a 



1487 Id. 

1488 Subcommittee interview of OCC AML Examiner Elsa de la Garza, (1/9/2012). 

1489 6/26/2008 OCC memorandum, "Pouch Transactions - Hokuriku Bank and SK Trading Company Ltd," at OCC- 
PSI-00885822, at 1. [Sealed Exhibit.] 

1490 Id. 

1491 Id. at 2. 

1492 Id. 

1493 Id. 

1494 Id. 

1495 Id. at 3. (emphasis omitted). 

1496 Id. at 4. 
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particular red flag, since the United States has long viewed Russia as a country of "primary" 
money laundering concern, its highest risk category. 1497 At the time, a 2008 report by the U.S. 
State Department, then the latest in a long line of annual U.S. State Department reports 
summarizing money laundering concerns on a country-by-country basis, described Russia as 
follows: 



"Criminal elements from Russia and neighboring countries continue to use Russia's 
financial system to launder money .... Experts believe that most of the illicit funds 
flowing through Russia derive from domestic criminal activity, including evasion of tax 
and customs duties and smuggling operations. Despite making progress in combating 
financial crime, Russia remains vulnerable to such activity because of its vast natural 
resource wealth, the pervasiveness of organized crime, and, reportedly, a high level of 
corruption. Other vulnerabilities include porous borders, Russia's role as a geographic 
gateway to Europe and Asia, a weak banking system with low public confidence in it, 
and under funding of regulatory and law enforcement agencies. Russia's financial 
intelligence unit (FIU) estimates that Russian citizens may have laundered as much as 
U.S. $11 billion in 2007." 1498 



When the Subcommittee asked the OCC about its 2008 inquiry into the Hokuriku 
travelers cheques, Ms. de la Garza stated that, despite the earlier AML examination in 2007, 
HBUS seemed to have no AML policies or procedures in place regarding pouch activity. 1499 She 
characterized the failure to monitor the travelers cheques being cashed as "not normal," and 
stated that they immediately brought the matter to the attention of HBUS AML Compliance. 
Ms. de la Garza indicated that, at first, HBUS Compliance personnel asserted that the travelers 
check transactions were legitimate, and that the high cost of cars in Russia accounted for the 
daily deposits of $500,000 or more by SK Trading. After doing additional research and finding 
additional accounts with high volumes of traveler cheque deposits, often sequentially numbered 
and signed and countersigned by the same person, she said that HBUS AML Compliance 
became more concerned. 1500 



On Sept. 2, 2008, the OCC examiners met with HBUS senior compliance officials Anne 



Liddy and Mary Ann Caskin. 1501 According to an OCC memorandum summarizing the meeting, 
Ms. Liddy disclosed that HBUS had reviewed: 

"all transactions over the past 2 months and identified a total of 20 entities (including SK 
Trading) which were using Cash Letter services to clear Travelers Cheques. All 20 
entites are used car dealerships. . . . Four additional companies with significant dollar 
amounts have been identified. (Marie Trading - $3.5 Million; Jamsou Traders - 
$lMillion; I K Auto - $929 Thousand and Dean Corp - $587 Thousand - totals for two 



1497 See, e.g., "International Narcotics Control Strategy Report, Volume II, Money Laundering and Financial 
Crimes," U.S. State Department (March 2008) at 62. 

1498 Id. at 390. See also "International Narcotics Control Strategy Report, Volume II, Money Laundering and 
Financial Crimes," U.S. State Department (March 2012) at 156 (identifying generally the same AML vulnerabilities 
in Russia today). 

1499 Subcommittee interview of OCC AML Examiner Elsa de la Garza (1/9/2012). 

1500 Id. 

1501 9/3/2008 OCC memorandum, "SK Trading Co Update," OCC-PSI-00885817. [Sealed Exhibit.] 
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months). . . . The Business Unit has gone back to the Relationship Manager and Hokuriku 
Bank to obtain additional information on Marie Trading and Jamsou Traders. They will 
also be inquiring on the other companies identified. . . . The bank will be exiting the 
Hokuriku relationship within the next 30 days." 1502 

The OCC informed the Subcommittee that the two OCC examiners who attended the meeting 
understood HBUS to mean that it would close the Hokuriku account, cease all business with the 
bank, and report any suspicious activity to U.S. law enforcement. 1503 



F. Absence of Hokuriku Bank KYC Information 



In July 2008, in response to the OCC, HBUS AML Compliance initiated a more in-depth 
review of the Hokuriku travelers cheques. A search of HBUS processing records determined 
that, over a 12-month period from 2007 to 2008, HBUS had received an average of 7,800 
travelers checks per month from the bank with an average monthly value of about $7.4 
million. 1504 HBUS determined that "[a]ll deposits are Travellers Checks, no Money Orders 
found." 1505 An HBUS AML Compliance officer also noted: "They seem to sell traveler's 
checks which are used to purchase cars in Japan. The purchasers of the cars often provide 
Russian passports as ID." 1506 

To find out more, on July 15, 2008, HBUS AML compliance officer Stephanie Napier 
sent an email to Yumi Seto at HSBC Tokyo, PCM Client Service, informing her that HBUS had 
undertaken a review of Hokuriku Bank Account No. 34738 and asking her to obtain specified 
KYC information related to certain deposits into that account. 1507 The Subcommittee was unable 
to determine why the email asked only about Hokuriku Account No. 34738 and not also Account 
No. 50385, where the travelers cheques were typically deposited. 1508 Nor was the Subcommittee 
able to determine why the email requested information about only four entities associated with 
the travelers cheque deposits: De Araujo Roseli Aparecida (an individual), Aksys Corp., R S 
Corp., and Sanhu Corp. 1509 

Ms. Napier made repeated requests for the information over the next two months without 
success. 1510 Her HSBC contact in Tokyo, Ms. Seto, repeatedly responded to her emails that 



1502 Id. 

1503 5/15/2012 email from OCC to the Subcommittee, "HSBC - Hokuriku Questions," PSI-OCC-38-0001-002. 

1504 7/16/2008 email from HBUS Jonathan Dean to HBUS Mary Ann Caskin and others, "Hokuriku Bank," OCC- 
PSI-00407498, at 1. 

1505 Id. 

1506 Id. 

1507 Email exchange among HBUS personnel, from July to Sept. 2008, "Hokuriku Bank Ltd- Compliance Inquiry," 
OCC-PSI-00409214-216 at 8-9. 

1508 See chart accompanying 3/15/2005 email from HBUS George Tsugranes to HBUS Nanayo Ryan, "Hokuriku 
Bank C/L Activity," HSBC OCC 31 13976-977; chart accompanying email exchange among HBUS AML 
Compliance personnel, from 1 1/23 - 1 1/29/2005, HSBC OCC 3180776-797; chart prepared by HBUS AML 
Compliance in 2007 regarding transactions in 2006, HSBC OCC 3352034-037. 

1509 Email exchange among HBUS personnel, from July to Sept. 2008, "Hokuriku Bank Ltd- Compliance Inquiry," 
OCC-PSI-00409214-216, at 9. 

1510 Id. at 4-8. 
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Hokuriku Bank had indicated it was preparing a "report." 1511 In September 2008, Ms. Seto was 
replaced by Ako Kobayashi who, after several attempts, obtained a single, handwritten page 
from the bank with the requested information. 1512 Because the information was provided in 
Japanese, she translated it and, on September 9, 2008, sent both the original and her typed 
translation to Ms. Napier's supervisor in HBUS AML Compliance Judy Stoldt. 1513 

The information provided by Hokuriku Bank was minimal. In the case of the one 
individual who had been identified, Hokuriku Bank reported that he was a "Business man," gave 
his address, and stated that he worked with a company called "Sugimoto," and had a 
"Satisfactory" relationship with the "Originator." In the case of the three corporations, Hokuriku 
Bank stated that each was involved in "Sales of Used Cars," which HBUS already knew, and 
provided the company's address, the date of establishment, and whether it was a private 
corporation or publicly traded. Hokuriku Bank also provided the name of one beneficial owner 
of one company, but wasn't sure of the spelling of his name. No reasons were given for its 
clients using sequentially numbered travelers cheques, having the same person sign and 
countersign them, or generating the high daily volume of cheques. Ms. Stoldt forwarded the 
information to her supervisor, Anne Liddy, characterizing it as "very limited information that 
took us over a month to get." 1514 

G. 2008 Decision to Stop Cashing Hokuriku Travelers Cheques 

On September 4, 2008, even before the KYC information from Hokuriku Bank was 
formally translated, HBUS PCM Compliance officer Alan Williamson sent an email to multiple 
HBUS personnel informing them that HBUS would no longer accept bulk travelers cheques from 
Hokuriku Bank for processing. He explained: 

"Compliance meets monthly with senior management in the Payments and Cash 
Management AML Management Review Committee. Recently we discussed the fact that 
Hokuriku has been sending a large number of sequential traveller's checks from a 
number of similar businesses through cash letter here in the US. This use of cash letter is 
inappropriate and the Committee has concluded that PCM should no longer allow 
Hokuriku to send traveler's checks through cash letter. Hokuriku should therefore cease 
the activity and make alternative arrangements, such as to make the deposits by wire, by 
September 30." 15 15 

The task of informing Hokuriku Bank was given to Machiko Yamashita, an HSBC 
employee in Tokyo who was then the designated Global Relationship Manager for Hokuriku 
Bank. 151 On September 11, 2008, he and a colleague met with Hokuriku officials who provided 



1511 Id. at 5-7. 

1512 Id. at OCC-PSI-00409215. 

1513 Id. at OCC-PSI-00409216. 

1514 Email exchange among HBUS personnel, from July to Sept. 2008, "Hokuriku Bank Ltd- Compliance Inquiry," 
OCC-PSI-00409214, at 1. The time period was actually closer to two months. 

1515 9/4/2008 email from HBUS Alan Williamson to HBUS Anthony Julian and others, "Hokuriku Bank," OCC-PSI- 
00808896, at 5. 

1516 Emails among HBUS and HSBC personnel from Sept. to Nov. 2008, "Hokuriku Bank," OCC-PSI-00808695, at 
5. 



254 



additional information about the travelers cheque deposits and asked HBUS to continue clearing 
them. According to Mr. Yamashita, Hokuriku Bank explained: 

"-Most of their customers related to this issue are used-car dealers for Russian buyers 
who are cash account holders of Hokuriku Bank through appropriate AML process. 
-The dealers are doing cash on delivery type of deals with buyers in this market therefore 
cash or TCs [travelers cheques] are normally used to accommodate those deals. As such 
Hokuriku Bank considers it is difficult for its customers to shift their payment method to 
wire transfers or commercial check[s] from TCs. . . . 

-Since relevant customers are limited [to] around 20 - 25 names and they are all cash 
account holders of Hokuriku Bank, Hokuriku Bank is well prepared to cooperate with 
HBUS by providing necessary information." 1517 

I CI o 

The email also stated: "HBUS is currently the sole Cash Letter provider for Hokuriku Bank." 

The next day, Anthony Julian responded that HBUS senior management had already 
reviewed the matter extensively "and determined that we can not continue to support this 
business. Th[i]s is not an issue for negotiation with Hokuriku." 1519 Mr. Yamashita replied, in 
that event, Hokuriku Bank had requested additional time to consider whether to end the business 
or find a replacement service provider. He wrote: "We suggest that we should withdraw very 
carefully given the fact that Japanese regional banks' world is very small. If we will push 
Hokuriku drastically, HSBC may likely have bad reputation on our PCM business in this 
marketplace." 1520 

A month later, on October 17, 2008, Mr. Julian sent an email to Albert Halley, head of 
the cash letter department at the Brooklyn processing center, advising him that Hokuriku Bank 
had been informed verbally and by letter that HBUS would "no longer accept bulk deposits" of 
travelers cheques "in excess of $5,000." 1521 Mr. Julian advised Mr. Halley that, after October 
31, 2008, any bulk travelers cheques received from the bank should be "returned to Hokuriku" 
via overnight mail. Mr. Halley responded that he had been told to return "any deposits" from 
Hokuriku Bank after October 31 - not just deposits in the form of travelers cheques — and asked 
Jonathan Dean in Compliance to "confirm/clarify this new request." 1522 After consulting with 
his supervisors, Mr. Dean clarified that no travelers cheques could be accepted from Hokuriku 
Bank, but that other commercial items could still be processed. 1523 Mr. Dean wrote that he 
expected the remaining volume to be "extremely low" and asked Mr. Halley to report on the 



1518 m; 

1519 Id. at 2-3. See also email exchange among HBUS and HSBC personnel from 9/4 to 9/1 1/2008, OCC-PSI- 
00196439 at 1. 

1520 Email exchange among HBUS and HSBC personnel from Sept. to Nov. 2008, "Hokuriku Bank," OCC-PSI- 
00808695, at 2. 

1521 10/17/2008 email from HBUS Anthony Julian to HBUS Albert Halley and others, "Hokuriku Bank," OCC-PSI- 
00808896, at 4-5. 

1522 10/20/2008 email from HBUS Albert Halley to HBUS Anthony Julian, Jonathan Dean, and others, "Hokuriku 
Bank," OCC-PSI-00808896, at 4. 

1523 Email exchange among HBUS personnel, from 10/20-10/31/2008, "Hokuriku Bank," OCC-PSI-00808896, at 1- 
3. 
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types of checks received from Hokuriku Bank after Oct. 31. This decision to continue the 
correspondent relationship varied from the September email in which senior HBUS AML 
Compliance official Anne Liddy told the OCC examiners that HBUS would be "exiting the 
Hokuriku relationship within the next 30 days." 1524 

H. Hokuriku Bank's Continued Lack of Cooperation 

Even after informing Hokuriku Bank that it would no longer process any travelers 
cheques, HBUS AML Compliance continued to seek KYC information from the bank in 
connection with the originators of the travelers cheques, in order to complete an analysis of the 
transactions and determine whether they involved suspicious activity and had to be reported to 
law enforcement. 



In late November or early December 2008, HBUS Compliance provided an update to the 
OCC about its efforts. According to an OCC memorandum summarizing the updated 
information, after receiving an inquiry from HBUS, the company issuing the travelers cheques 
dispatched investigators to the Russian bank where the travelers checks were being 
purchased. 1525 The OCC report stated: 

"The result was that five individuals were identified who were purchasing the travelers 
checks with cash at the bank. The five individuals were then providing the checks to Mr. 
Alexander Tokarenko who is the owner of SK Trading. Mr. Tokarenko then stamped the 
checks payable to SK Trading." 

All five individuals were Russians living in Russia. The memorandum stated that HSBC was 
attempting to determine if Mr. Tokarenko owned, not only SK Trading, but also the 29 other 
entities that had been identified as clearing bulk travelers cheques with HBUS. The OCC 
memorandum reported that "the total dollar amount of bulk travelers' checks processed by 
HSBC for the 30 entities during the period of November 2007 to October 2008 was over $61 
million." 1526 



In late November 2008, HBUS AML Compliance personnel drafted a new information 
request and asked Stephanie Brown to forward it to Hokuriku Bank. It asked whether five 
named Russians (identified in the earlier investigation) were or had been account signatories or 
"connected in any way" with the accounts opened by 30 specified corporations and individuals 

1527 

involved with the bulk travelers cheques. Ms. Brown forwarded the request to Ako 
Kobayashi at HSBC in Tokyo who, in turn, sent it to Hokuriku Bank. 1528 

On December 3, 2008, Ms. Kobayashi sent an email to Ms. Brown indicating that 
Hokuriku Bank had raised the following questions: 



1524 See 9/3/2008 OCC memorandum, "SK Trading Co Update,"OCC-PSI-00885817. [Sealed Exhibit.] 

1525 12/1/2008 OCC memorandum, "SK Trading," OCC-PSI-00888526. [Sealed Exhibit.] 

1526 Id. 

1527 Email exchange among HBUS personnel, from Nov. to Dec. 2008, "Hokuriku Bank," OCC-PSI-0081 1358, at 
10-13. SK Trading Company was one of the 30. 

1528 Id. at 9-10. 



256 



"What is the background for your queries? Does it related to your compliance reason or 
does it relate to criminal act and the police asks such information? Where did you get 
those Russian names? Since no cheques has been presented to you since Nov08, why 
such information is required now?" 1529 

HBUS explained that the information was needed to complete an internal investigation, and was 
not being requested in connection with a criminal prosecution. 1530 Hokuriku Bank responded 
that it did not retain signatory cards or ownership information for the 30 accounts and had to 
identify and contact each of its branches where the 30 accounts were opened, which would take 
time. 1531 



On December 15, 2008, Ms. Kobayashi sent an email to multiple HBUS AML personnel 
ling add 
She also wrote: 



1 

forwarding additional questions from Hokuriku Bank about the new request for information. 



"Please be advised that apparently they are not very happy with your request as they have 
other matters to attend toward the end of the year. . . . Hokuriku Bank is not saying that 
they will not assist you to provide the required information however they are upset with 
the nature of the request without being given sufficient background. Given the nature of 
the queries, please understand it is time consuming and consider to allow them more 
time. They might not be able to supply the information by the end of the year." 

Two days later, Denis O'Brien, head of HBUS Global Transaction Banking Compliance, 
sent an email answering the questions posed by Hokuriku Bank. 1534 Later that same day, the 
HSBC Money Laundering Control Officer in Japan, Shinji Kawamura, sent an email to Mr. 
O'Brien indicating that Hokuriku Bank would not provide the requested information. He wrote: 

"They have been good enough to provide information so far but as you may understand 
from bank secrecy viewpoint, they should not or cannot disclose customer information. 
So they will no longer provide information. If you need my suggestion to clear those 
backlogs, I will tell you that you should file suspicious transaction report to your 
authority." 1535 

Notwithstanding that communication, two days later, on December 19, 2008, Ms. Kobayashi 
sent Mr. O'Brien an email stating that Hokuriku Bank "has provided the information at their risk 
and confirmed that the purchasers of the travelers checks . . . are not signers or are NOT 
connected in any way to the previously requested named relationships at Hokuriku Bank. This 

in/: 

should be the last favour and we cannot expect further or next assistance from them." 



1529 Id. at 9. 

1530 Id. at 8. 

1531 Id. at 6. 

1532 Id. at 4-5. 

1533 Id. at 5. 

1534 Id. at 3-4. 

1535 Id. at 2. 

1536 Id. at 1. 
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Mr. O'Brien responded: "We are appreciative of your assistance and thank you for your 
diligence in this regard. We have closed our investigation as it related to this issue." 1537 

The Subcommittee contacted Hokuriku Bank to learn more about the travelers cheques. 
The bank provided this additional information: 

"Due to the geographic proximity of Russia across the Sea of Japan, many Japanese 
dealers of pre-owned automobiles are located along the coast, including the Hokuriku 
region. (Hokuriku means 'North Land' in Japanese.) Hokuriku Bank is headquartered in 
this area and has several branches in the surrounding areas. Some of such dealers have 
accounts at Hokuriku Bank. 



In a typical transaction, a customer of Hokuriku Bank (that is to say an account holder) 
sells a used car (or cars) to a Russian buyer who is a passenger or crew member of a ship 
at a nearby port. The buyer pays with travelers' checks. The seller/account holder brings 
the travelers' cheques to its bank (Hokuriku) and deposits them into its account. 
Hokuriku Bank accepts the travelers' checks, credits the customer's account, and sends 
the checks to clearing banks." 1538 

This description, which seems to describe a thriving used car business in northern Japan, does 
not explain why a single individual in Russia was using five individuals to purchase millions of 
dollars of sequentially numbered U.S. dollar travelers cheques from the same bank in Russia per 
month, and then signing and countersigning all of them. Nor does it explain why the parties 
were using U.S. dollars to purchase used cars located in Japan or why the Hokuriku branches had 
so little information about the 30 clients carrying in U.S. dollar travelers cheques totaling about 
$500,000 to $600,000 each day. 

In February 2009, HBUS closed one of the accounts held by Hokuriku Bank, Account 
No. 50385, and transferred its balance to Account No. 34738. HBUS has not explained why it 
closed one account but not the other, or why Account 34738 was kept open when it was the 
subject of the extended HBUS inquiries to Hokuriku Bank in 2008. Because the one account 
remained open, the correspondent relationship between HBUS and Hokuriku Bank continued. 1539 
The OCC examiners told the Subcommittee that they had thought all of the Hokuriku accounts 
had been closed in 2008, and were unaware of the ongoing relationship for some time. 1540 



6/26/2012 letter from Hokuriku Bank's legal counsel to the Subcommittee, at 4, PSI-HokurikuBank-01-0001. 

1539 HBUS KYC Profile of Hokuriku Bank, at HSBC-PSI-PROD-0102415, 420. 

1540 Subcommittee interviews of Joseph Boss (1/30/2012) and Elsa de la Garza (1/9/2012); 5/15/2012 email from 
OCC to the Subcommittee, "HSBC - Hokuriku Questions," PSI-OCC-38-0001-002. 
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I. 2010 OCC Discovery of Hokuriku Account Activity 

Two years later, in the summer of 2010, two OCC AML examiners conducted a review 
of RDC services at the HBUS Buffalo processing center, including RDC processing of monetary 
instruments presented for deposit through electronic images. 1541 During that review, one of the 
examiners was surprised to discover that the Hokuriku account was not only still open, but that 
HBUS was processing monetary instruments for Hokuriku Bank through RDC. 1542 In an email 
to the OCC Examiner-in-Charge summarizing the RDC concerns that were communicated to 
HBUS after the examination field work, the examiner included: "Concern related to pouch 
activity being conducted by HSBC for Hokuriku." 1543 He informed the Subcommittee that the 
volume of activity was "significant, but not as extensive as in 2008." 1544 

In October 2010, a draft OCC Supervisory Letter detailing AML deficiencies in HBUS' 
RDC operations specifically identified concerns related to Hokuriku Bank. After describing the 
problems uncovered in 2008, involving the bulk processing of Hokuriku travelers cheques, the 
letter stated: 



"[I]n late 2008, early 2009, bank management informed the OCC that it would terminate 
the account relationship with Hokuriku. During the OCC's RDC review, it was again 
found that pouch activity was being conducted by HSBC for Hokuriku. Upon further 
review, it was determined that at the time that the Bank was to have initially severed its 
relationship with Hokuriku, there existed two separate accounts for Hokuriku. At that 
time, management decided to close the account in which the aforementioned deposits [of 
travelers cheques] were being processed and continue to maintain the other account. It 
was through the second account that the pouch activity continued." 1545 

The draft OCC letter also recited a long list of AML concerns involving the bank's pouch 
activity. The final version of this Supervisory Letter included most of the information in the 
draft, but dropped the paragraph that singled out Hokuriku Bank. 1546 OCC personnel asked 
about the letter were unable to remember why the reference to Hokuriku Bank had been 
dropped. 1547 HBUS' legal counsel told the Subcommittee that HBUS stopped processing 
travelers cheques through the Hokuriku account in 2008. 1548 Hokuriku Bank similarly informed 
the Subcommittee that HBUS stopped processing its travelers cheques in October 2008. 1549 

The HBUS KYC Profile of Hokuriku Bank, updated in 2010, referenced ongoing AML 
concerns related to the bank, perhaps due to the OCC's renewed interest in the relationship. 



1541 See 10/4/2010 draft Supervisory Letter from OCC to HBUS, OCC-PSI-00863984-992. 

1542 See 9/3/2010 email from OCC Joseph Boss to OCC Sally Belshaw and others, OCC-PSI-00887684-685. 

1542 HBUS KYC Profile at HSBC-PSI-PROD-0 102421; 5/15/2012 email from OCC to the Subcommittee, "HSBC - 
Hokuriku Questions," PSI-OCC-38-0001-002. 

1543 Id. 

1544 5/15/2012 email from OCC to the Subcommittee, "HSBC - Hokuriku Questions," PSI-OCC-38-0001-002. 

1545 10/4/2010 draft Supervisory Letter from OCC to HBUS, at OCC-PSI-00863990. 

1546 10/21/2010 Supervisory Letter HSBC-2010-24 from OCC to HBUS, OCC-PSI-00880181-185. 

1547 Subcommittee interview of Teresa Tabor (5/17/2012). 

1548 Subcommittee briefing by HSBC legal counsel (5/9/2012). 

1549 6/26/2012 letter from Hokuriku Bank's legal counsel to the Subcommittee, at 1, PSI-HokurikuBank-01-0001. 
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Among other matters, the KYC Profile indicated that, as of September 2010, despite a 
relationship of many years, HBUS did not have a copy on file of Hokuriku's KYC or AML 
policies and procedures. 1550 The profile also indicated that HBUS had sent an AML 
questionnaire to the bank, but Hokuriku Bank had not yet returned it. HBUS also noted in the 
2010 profile that Hokuriku Bank did not have an independent AML compliance function within 
the bank, raising further questions about Hokuriku's AML efforts. 1551 

In May 2012, HBUS closed the Hokuriku Bank account. 1552 While that action ended the 
direct relationship, Hokuriku Bank still has correspondent relationships with other HSBC 
affiliates which, in turn, have correspondent accounts at HBUS. Accordingly, it is still possible 
for Hokuriku Bank to obtain U.S. dollar services through the U.S. dollar correspondent accounts 
of the HSBC affiliates, although Hokuriku Bank told the Subcommittee it is not doing so. 

J. Analysis 

As a major global bank, HBUS serves as a gateway for foreign banks to obtain U.S. 
dollars, including through the clearing of U.S. dollar travelers cheques. HBUS AML 
Compliance personnel knew that travelers cheques were vulnerable to money laundering abuses, 
and that large numbers of sequentially numbered travelers cheques were a red flag. In 2003, it 
set up a data system that captured travelers cheque information, but in five years, appeared not to 
use it to identify suspicious activity or high risk clients. In 2007, the OCC found that HBUS 
essentially had no effective AML controls over the process used to cash travelers cheques and 
required the bank to strengthen its policies and procedures. 

The Hokuriku Bank example illustrates the problem. For years, Hokuriku Bank routinely 
presented a large volume of travelers cheques to HBUS for processing. Most involved 
sequentially numbered cheques signed and countersigned illegibly by the same person. For 
years, HBUS cleared the cheques with few questions asked. The cheque volume, which 
involved $500,000 to $600,000 in travelers cheques per day and $70 to $90 million per year, 
produced a four- year total of more than $290 million. When directed by OCC to look into the 
transactions, HBUS quickly discovered that most of the cheques were being purchased for cash 
by Russians at a Russian bank and sent to Hokuriku Bank accounts in Japan. HSBC discovered 
that Hokuriku Bank had virtually no information about a network of 30, possibly related, 
accountholders who were physically turning in large stacks of sequentially numbered U.S. dollar 
travelers cheques to the bank every day. When asked about the accounts by HBUS, Hokuriku 
Bank resisted finding out and claimed bank secrecy requirements prevented it from disclosing 
client- specific information. HBUS also learned it was the only bank cashing the Hokuriku 
travelers cheques. Later, in 2010, HBUS discovered that Hokuriku Bank had no separate AML 
compliance function and was left waiting to receive a copy of its written AML policies and 
procedures. After the Subcommittee inquired about the account, HBUS closed it, although other 
HSBC affiliates are continuing to service the bank. 



HBUS KYC Profile at HSBC-PSI-PROD-0 102421. 
Id. 

6/26/2012 letter from Hokuriku Bank's legal counsel to the Subcommittee, at 1, PSI-HokurikuBank-01-0001. 



260 



HBUS enabled a number of Russians engaged in suspicious activity to use a relatively 
small Japanese bank with weak AML controls to gain access to over $290 million in U.S. dollars 
in less than four years. HBUS continued to clear the travelers cheques even after it learned of 
the transactions' suspicious nature. In so doing, HBUS facilitated the suspicious transactions 
and failed to live up to its AML obligations, all in return for about $47,000 in annual revenues. 
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VII. HBUS PRIVATE BANK AMERICAS: OFFERING BEARER 
SHARE ACCOUNTS 

Over the course of a decade, HBUS allowed over 2,000 customers to open accounts in 
the name of bearer share corporations, a type of corporation that allows secrecy by assigning 
ownership to whomever has physical possession of the shares. At its peak, the Miami office had 
over 1,670 bearer share accounts; the New York office had over 850; and the Los Angeles office 
had over 30. The Miami bearer share accounts alone held assets totaling an estimated $2.6 
billion, generating annual bank revenues of $26 million. Multiple internal audits and regulatory 
examinations criticized the accounts as high risk and advocated that HBUS either take physical 
custody of the shares or require the corporations to register the shares in the names of the 
shareholders. 

In 2007, HBUS Compliance circulated a draft to standardize bearer share AML 
safeguards across the bank, including by designating all of the bearer share accounts as high risk 
clients requiring enhanced due diligence and monitoring. Internal documents show Miami and 
New York bank personnel successfully weakened the standards by enabling the majority of 
accounts not to be treated as high risk and requiring updated ownership information only once 
every three years. Later, HBUS learned that the British Virgin Islands (BVI), which formed 
most of the bearer share corporations with HBUS accounts, was requiring the registration of all 
outstanding BVI bearer shares by the end of 2009. In response, HBUS initiated an effort to 
require its BVI accountholders to register their shares by the legal deadline. In 2010, HBUS also 
contacted its other bearer share accountholders, requiring them either to register their shares or 
place their shares in the custody of HBUS or a third party. HBUS ended up obtaining registered 
shares or share custody for 1155 accounts, closed over 530 accounts, and by 2012, had 
substantially reduced the number of bearer share accounts it maintained to 26. 

Two examples of the accounts illustrate the risks they pose. In the first, two Miami 
Beach hotel developers, Mauricio Cohen Assor and Leon Cohen Levy, a father and son, used 
bearer share accounts they opened for Blue Ocean Finance Ltd. and Whitebury Shipping Time- 
Sharing Ltd. to help hide $150 million in assets and $49 million in income. In 2010, both were 
convicted of criminal tax fraud and filing false tax returns, sentenced to ten years in prison, and 
ordered to pay back taxes, interest, and penalties of more than $17 million. A second example 
involves two Panamanian bearer share corporations, Urigeler International S.A. - Holding 
Company and Birmingham Merchant S.A. - Holding Company, beneficially owned by a wealthy 
and politically powerful family in Peru. The family sought a waiver from HBUS' AML 
requirements to avoid registering their shares or placing them in bank custody. When asked 
whether the waiver was granted when the account was opened in 2007, HBUS legal counsel told 
the Subcommittee that "we don't know." The account was closed in 201 1 . These accounts 
demonstrate the risks associated with bearer share accounts, whose owners seek to hide their 
identities. Today, HBUS has 26 bearer share accounts left, most of which are frozen, but also 
maintains a policy allowing the bank to open more bearer share accounts in the future. 
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A. High Risk Corporate Accounts 

Bearer share accounts have long been viewed as being at high risk for money laundering, 
due to the ability of bearer shares to hide ownership of a corporation. A 2005 U.S. Money 
Laundering Assessment defined bearer shares as follows: 

"Bearer shares are negotiable instruments that accord ownership of a company to the 
person who possesses the share certificate. Such share certificates do not contain the 
name of the shareholder and are not registered, with the possible exception of their serial 
numbers. Accordingly, these shares provide for a high level of anonymity and are easily 
negotiable." 1553 

Because of the ease of transfer and secrecy attached to bearer share corporations as well as their 
attractiveness to money launderers and terrorist financiers, their propensity for misuse have made 
them lose favor with governments and AML organizations. 

Financial Action Task Force. The Financial Action Task Force (FATF) is the leading 
international AML body. 1554 In its 2006 report, "The Misuse of Corporate Vehicles, Including 
Trust and Company Service Providers," FATF highlighted the AML problems associated with 
bearer share corporations. FATF explained that anonymity is a critical factor in facilitating the 
misuse of corporate vehicles, and bearer shares present a "special challenge to determining 
beneficial ownership of a corporate vehicle" because these shares "can be easily transferred 
without leaving a paper trail." 1555 The FATF report noted that, while bearer shares can be used 
for legitimate purposes, they were also used for "money laundering, self -dealing, and/or insider 
trading." 1556 

Organisation for Economic Co-operation and Development. The Organisation for 
Economic Co-operation and Development (OECD) is a 50-year-old membership organization of 
34 countries including the United States, which tackles issues of common interest to promote 
economic development. In a 2001 report, "Behind the Corporate Veil," the OECD identified 
bearer shares as one of the primary means used to achieve anonymity for the beneficial owners 
of corporations. The OECD report noted that bearer shares' high level of anonymity and ease of 
transfer "make them attractive for nefarious purposes, such as money laundering, tax evasion and 

1558 

other illicit conduct, especially when they are issued by private limited companies." The 



1553 12/2005 "U.S. Money Laundering Threat Assessment," issued by the Money Laundering Threat Assessment 
Working Group, which included the U.S. Departments of Treasury, Justice, and Homeland Security, Federal 
Reserve, and Postal Service, http://www.justice.gov/dea/pubs/pressrel/011106.pdf, at 47. 

1554 See FATF website, www.fatf-gafi.org. 

1555 10/13/2006 "The Misuse of Corporate Vehicles, Including Trust and Company Service Providers," at 10, FATF 
Publication, http://www.fatf-gafi.org/media/fatf/documents/reports/ Misuse%20of%20Corporate%20 
Vehicles%20including%20Trusts%20and%20Company%20Services%20Providers.pdf 

1556 Id. at 16. 

1557 See OECD website, www.oecd.org. 

1558 "Behind the Corporate Veil: Using Corporate Entities for Illicit Purposes," OECD publication, at 30 
http://www.oecd.Org/dataoecd/0/3/43703185.pdf. 
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OECD noted that bearer shares were especially vulnerable to misuse, because of the lack of 
information available to authorities in the event of an investigation. 1559 

U.S. Government. The United States has also criticized bearer share corporations. In 
2005, for example, multiple U.S. agencies worked together to produce a U.S. Money Laundering 
Threat Assessment to identify key money laundering methods. 1560 The Assessment identified 
the use of shell corporations as a key AML problem and singled out bearer shares as one of the 
means, along with nominee shareholders and directors, "to mask ownership in a corporate 
entity." 1561 It warned that bearer shares "provide money launderers with the tools to hide their 
identity from financial institutions and law enforcement." In addition, federal financial 
regulators warn about the risks associated with bearer shares, because they allow "ownership of 
the corporation to be conveyed by simply transferring physical possession of the shares." 156 
The federal regulators' joint AML examination manual states that due to the risk, "in most cases 
banks should choose to maintain (or have an independent third party maintain) bearer shares for 
customers." 1564 



World Bank. A 201 1 report issued by the World Bank on corporate transparency issues 
is a recent example of an international body condemning use of bearer share corporations. It 
indicates that, in recent years, bearer share corporations have "generally been frozen out of the 
financial sector," asserts that "[n]o bank with any sort of due diligence standards is willing to 
conduct business with a company that has free-floating bearer shares," but also states that such 
corporations remain an AML threat: 

"Concerns have been raised in AML forums that companies that issue bearer shares are 
used extensively for illegal activities, such as tax evasion and money laundering .... In 
most jurisdictions, bearer-share statutes have generally been undergoing a process of 
reform and elimination .... 



Financial compliance officers and company service providers report that bearer shares 
have generally been frozen out of the financial sector even if they are still permitted by 
the laws of a particular jurisdiction. No bank with any sort of due diligence standards is 
willing to conduct business with a company that has free-floating bearer shares. 
Companies that are not required under their own laws to have bearer shares immobilized 
will typically have to place the share in the trust of an agent of the bank, as a condition of 
being accepted as a customer. . . . 



1559 Id. 

1560 See 12/2005 "U.S. Money Laundering Threat Assessment," issued by the Money Laundering Threat Assessment 
Working Group, which included the U.S. Departments of Treasury, Justice, and Homeland Security, Federal 
Reserve, and Postal Service, http://www.justice.gov/dea/pubs/pressrel/011106.pdf. 

1561 Id. at 47. 

1562 Id. at 48. 

1563 4/29/2010 "BSA/AML Examination Manual," Federal Financial Institutions Examination Council, "Bearer 



Shares," at 282, http://www.ffiec.gov/bsa_aml_infobase/documents/BSA_AML_Man_2010.pdf. 
1564 Id. The AML examination manual also stated: "In rare cases involving lower-risk, well-kno' 
customers, banks may find that periodically re-certifying beneficial ownership is effective." Id. 
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Given the legislative reforms of the past decade and the fact that bearer shares or share 
warrants featured in roughly 1 percent of the grand corruption cases we reviewed, one 
might be inclined to consider bearer securities to be a problem of the past. Investigators 
interviewed for this study from Latin America and the Caribbean disagree, however. 
They maintain that bearer-share companies are still a problem for money laundering 
investigations, that their anonymity prevents detection and impedes prosecution, and that 
corrupt individuals still can gain access to financial systems and undertake anonymous 
transactions involving considerable sums. 

In practice, there is scant business rationale for the continued use of bearer securities. The 
claims that bearer securities are necessary to facilitate transfer of ownership and enhance 
liquidity no longer hold for the vast majority of countries. An electronic system of 
registered shares is clearly a more efficient platform for transferring equity interests. In 
this case, the risks outweigh the benefits." 1 65 

B. Bearer Share Activity at HBUS 

Despite the widespread, longstanding international condemnation of bearer share 
corporations, until last year, HBUS maintained hundreds, sometimes thousands, of bearer share 
accounts in the United States. At its peak, HBUS had over 2,000 bearer share accounts, 
including 1,667 accounts at the International Private Bank in Miami, 1566 851 at the International 
Private Bank in New York; and 33 at the International Private Bank in Los Angeles. The 
Miami bearer share accounts alone have held assets totaling an estimated $2.6 billion and 
produced revenues to the bank of $26 million per year. 1569 

These accounts were overseen by two different federal banking regulators. The OCC 
oversaw the accounts in New York and Los Angeles, which were held in the HBUS International 
Private Banking division. The bearer share accounts in Miami, however, were lodged with a 
different HBUS subsidiary, which was often called an International Private Bank, but was 
actually formed under the Edge Act, a federal law which allows corporations to be chartered by 
the Federal Reserve, engage solely in international banking, and serve only non-U. S. citizens 



"Puppet Masters: How the Corrupt Use Legal Structures to Hide Stolen Assets and What to Do About It," 
World Bank (201 1), at 41, 43-44. 

1566 See 10/2007 "HSBC Group Financial Services and European Audit Report on HSBC Private Bank International 
, Miami and HBUS Domestic Private Banking- Florida Region," OCC-PSI-00223637 (citing 1,667 accounts in 
October 2007); 12/1 1/2007 email from HBUS Jeff Clous to HBUS Paul O'Sullivan and others, "Bearer Share 
Corporation Policy," OCC-PSI-00226652 (citing 1,679 accounts in December 2007); but see OCC-PSI-00217164 
(estimating 600 accounts in July 2007). 

1567 See 10/2007 "HSBC Group Financial Services and European Audit Report on HSBC Private Bank International 
, Miami and HBUS Domestic Private Banking- Florida Region," OCC-PSI-00223637 (citing 851 accounts in 
November 2005); see 8/27/2007 email from Alan Williamson to Terry Westren, OCC-PSI-003 18438, with 
accompanying 2007 List of New York Bearer Share Accounts, OCC-PSI-003 18439 (citing 636 accounts in August 
2007). 

1568 1 1/1 1/2005 memorandum from OCC C. Seiler, "Bearer Share Activity," at 2, OCC-PSI-0 1437596 (citing 33 
accounts in November 2005). 

1569 12/1 1/2007 email from HBUS Jeff Clous to HBUS Paul O'Sullivan, "Bearer Share Corporation Policy," OCC- 
PSI-00226652. 
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with U.S. banking needs. 1570 Edge Act corporations are regulated by the Federal Reserve. 1571 
The Miami bearer share accounts were accordingly overseen by the Federal Reserve Bank of 
Atlanta which conducted an annual examination of its operations. 1572 

HBUS' bearer share accounts repeatedly raised AML concerns largely because the 
accounts suffered from missing or inadequate KYC information. A 2004 internal audit of 
HBUS' Private Bank International in Miami by HSBC Group auditors found, for example, that 
sixty bearer share accounts lacked "Certificates of Beneficial Owner" forms, meaning the bank 
had no information on who owned the accounts. The audit also repeated a recommendation 
carried forward from a 2002 Group Audit that management should obtain the missing beneficial 

1573 

ownership information "at the earliest opportunity," suggesting the ownership information 
had been missing for at least two years. In February 2005, an HBUS Monthly Private Banking 
Compliance Report to HSBC Group noted that ten bearer share accounts had been frozen due to 
missing "Beneficial Ownership Letters," and Relationship Managers for the accounts had been 
notified they had 30 days to obtain the needed documents or the accounts would be closed. 1574 

OCC Concern. In 2005, the OCC identified the HBUS bearer share accounts as an 
AML concern and, in 2006, directed HBUS to assess their AML risk and take physical control of 
the bearer shares. 

In November 2005, the OCC conducted an AML examination of HBUS' International 
Private Banking division and looked at the bearer share accounts in its New York and Los 
Angeles offices. In November 2005, an OCC AML examiner wrote an internal memorandum 
summarizing HBUS' "Bearer Share Activity" and recommending that HSBC adopt a policy to 
"ensure that either the bank or an acceptable third party controls the bearer shares." 1575 The 
memorandum stated that the HBUS New York office then had 851 bearer share accounts and the 
California office had 33. 1576 The memorandum explicitly noted the AML risks attached to the 
bearer share accounts and the need to obtain satisfactory evidence of the accounts' beneficial 
owners. It noted that bearer share certificates allowed corporate ownership to be transferred 
without the bank' s knowledge, and OCC policy was to require banks to maintain control of all 



See 6/12/2008 letter from FRB of Atlanta Robert Schenck to HSBC Private Bank International Board of 
Directors, OCC-PSI-00107444-449; Section 25A of the Federal Reserve Act, P.L. 102-242, codified at 12 U.S.C. 
§§611-631. 

1571 Section 25A of the Federal Reserve Act, P.L. 102-242, codified at 12 U.S.C. §§611-631. 

1572 The Miami Edge Act corporation has undergone annual Federal Reserve audits since at least 2006. 

1573 2/2004 Group Financial Services Audit Report on High Level Controls Review of HSBC Private Bank 
International, at 5, OCC-PSI-00210878. 

1574 3/7/2005 report from HSBC Carolyn Wind and HSBC Teresa Pesce to HSBC Curt Cunningham and HSBC 
Anthony Gibbs, "Monthly Private Banking Compliance Report for February 2005," HSBC OCC 7695260-266. 

1575 1 1/1 1/2005 OCC memorandum, "Bearer Share Activity," OCC-PSI-01437596. According to the memorandum, 
the policy at the time was that the International Private Bank required the following for each bearer share account: 
an explanation for opening the account, CEO approval, and completion of a beneficial ownership letter, to be 
certified every 3years, identifying the beneficial owners of the bearer share company. 
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bearer shares. The memorandum also discussed new legislation in the British Virgin Islands 
that "provides a legal framework for immobilizing bearer shares." 1578 

As a result of the AML examination, on January 31, 2006, the OCC issued a Supervisory 
Letter to HBUS which included a Matter Requiring Attention (MRA) of the HBUS Board of 
Directors directing HBUS to strengthen AML controls over its bearer share accounts. 1579 The 
Supervisory Letter stated: 

"Management should evaluate the risks associated with bearer share accounts. 
BSA/AML policy and procedures need to be revised to ensure that either the bank or an 
acceptable third party controls the bearer shares. The bank must monitor legal 
requirements in countries that allow for the organization of International Business 
Companies (IBCs) and Private Investment Companies (PIC). Policies and procedures 
need to define 'acceptable third parties' and any applicable due diligence, and specify 
documentation required by the bank to ensure that the shares have been properly received 
by the third party custodian." 1580 

The Supervisory Letter also stated that HBUS management had "agreed to implement revised 
policies and procedures for bearer shares in accordance with our recommendation by March 31, 
2006." 1581 When asked about this Supervisory Letter, the OCC Examiner-in-Charge at HBUS, 
Anthony DiLorenzo, did not remember the bearer share issue, but said that, aside from HSBC, he 
had not seen bearer share accounts at other large banks that he oversaw. 1582 

On March 3, 2006, HBUS responded to the Supervisory Letter with a proposal that did 
not completely follow the OCC instruction on bearer shares. Instead of requiring that all bearer 
share certificates be placed in custody for all of its bearer share accounts, HBUS indicated that it 
would require custodization only for what it deemed to be high risk bearer share accounts. For 
lower risk bearer share accounts, HBUS would not take possession of the shares, but would 
allow accountholders to submit to the bank a "beneficial ownership letter" every two years 
stating who had possession of the corporate shares. HBUS committed to having a plan in place 
to implement this approach by March 31, 2006. 1583 

At the same time the OCC was reviewing the New York and Los Angeles bearer share 
accounts, the Federal Reserve was performing a "risk-focused examination" of the Edge Act 
subsidiary holding the Miami accounts, HSBC Private Banking Interational. In January 2006, 



1577 Id. 

1578 Id. (explaining that, under the BVI legislation, international corporations formed after January 1, 2005 would 
have to have their shares held by either an "authorized" or "recognized" custodian. Companies formed prior to 
January 1, 2005, would have a transition period in which to either have the shares registered or have them held by a 
custodian). 

1579 1/31/2006 OCC Supervisory Letter, "International Private Banking BSA/AML Examination," OCC-PSI- 
00000317. [Sealed Exhibit.] 

1580 Id. at 3. 

1581 Id. 

15 2 Subcommittee interview of Anthony DiLorenzo (3/22/2012). 

1583 3/3/2006 letter HSBC Teresa Pesce to OCC Anthony DiLorenzo, "International Private Banking BSA/AML 
Examination," at 2, OCC-PSI-01358804-821. 



267 



the Federal Reserve issued a Report of Examination (ROE) deeming the overall risk 
management framework for the Miami operation as satisfactory, while identifying as its 
"primary risk" the "reputational risk, arising from its international private banking and wealth 
management activities that are directed towards a high net-worth Latin American client 
base." 1584 The ROE also deemed the Miami office's AML program as adequate, while noting 
numerous issues involving offshore accounts, unavailable offshore documentation, offshore shell 
companies "serving as operating accounts," and the addition of international private banking 
accounts moved from New York which added "in excess of $1 billion" to the assets under 
management in Miami, but made no mention of bearer share accounts. 

In February 2006, as the OCC deadline approached for implementing stronger AML 
controls over HBUS' bearer share accounts, the head of HBUS' International Private Bank (IPB) 
Operations in Miami, Jeff Clous, asked a Miami law firm prepared an analysis for the bank on 
the Federal Reserve's policy regarding bearer share accounts. According to Mr. Clous, the law 
firm reported that the Federal Reserve expected banks to conduct a risk assessment and assign 
risk classifications to each account for risk-based monitoring. According to Mr. Clous, the law 
firm also informed him that the Federal Reserve provided banks with the option of either 
obtaining custody of the bearer shares or recertifying beneficial ownership of the shares on a 
periodic basis, based upon the account's risk classification. 1586 

Mr. Clous emailed his report of the law firm's analysis to senior personnel in the New 
York International Private Bank (IPB), the CEO of Private Bank America, Philip Musacchio, the 
Chief AML Officer of Private Bank, Susan Hoggarth, and the Head of Private Bank Operations 
Terry Westren. Mr. Musacchio responded that New York would prefer to adopt this "much 

1587 

better and reasonable approach." Ms. Hoggarth replied: 

"That may work for Miami, but it won't work for the OCC in NY and California. The 
OCC has specifically advised us that the Beneficial Ownership letters are not sufficient. 
We have been advised that the shares need to be held either by ourselves or an accepted 
third party." 1588 

Mr. Musacchio responded that he had assumed that Ms. Hoggarth would explain the Federal 
Reserve's position to persuade the OCC to agree to the same approach. 1589 Ms. Hoggarth replied 
that the OCC examiners had already advised the bank that beneficial ownership letters were not 
adequate, and she did not think the OCC would accept the Federal Reserve's approach. 1590 

When the OCC's bearer share deadline arrived at the end of March 2006, however, little 
had changed in either the New York or Miami IPB offices. Both continued their policy of 



1584 1/19/2006 letter from FRB Atlanta to HSBC Private Bank International Board of Directors, OCC-PSI-00309434. 
[Sealed Exhibit.] 

1585 Id. at 2, 4-6. 

1586 2/9/2006 email exchanges among HBUS Susan Hogart, HBUS Philip Musacchio, HBUS Jeff Clous, HBUS 
Teresa Pesce, and HBUS Terry Westren, "Bearer Shares - More Info," HSBC OCC 4816460-462. 

1587 Id. 

1588 Id. 

1589 Id. 

1590 Id. 
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obtaining periodic beneficial ownership letters from most accounts, and arranging for shares to 
be taken into custody only for a small percentage of accounts deemed to be higher risk. 

The documents reviewed by the Subcommittee also contain no indication that the OCC 
followed up with HBUS on the bearer share MRA in the 2006 OCC Supervisory Letter. When 
asked why, the OCC AML Examiner told the Subcommittee that he had been informed by 
HBUS that it had closed all of its bearer share accounts in 2006, and didn't learn until 2010, that 
the bearer share accounts had, in fact, remained open. 1591 

Proposed Job Aid on Bearer Shares. From at least 2002 to 2007, HBUS did not have a 
standard policy establishing how its various branches should handle bearer share issues and what 
AML safeguards should be used. 1592 In early 2007, HBUS undertook an effort to develop a 
standard bearer share policy that would apply to all HBUS offices. It was an effort that would 
take the rest of the year. 

An HBUS AML Compliance officer located in New York, Ali Kazmy, was tasked with 
developing the policy. In February 2007, he emailed his supervisor, Mary Caskin, that he hoped 
to finalize a draft that week. 1593 Internal documents indicate that, a few months later, the draft 
was circulated to other HBUS Compliance personnel for comment. At least one colleague 
sought to strengthen it. On April 17, 2007, HBUS AML Compliance officer Robert Guthmuller 
sent an email to colleagues stating that the policy should not make it optional for bearer shares to 
be classified as high risk. Mr. Guthmuller contended that approach did not mirror other banks' 
policies: "For at least the last 10 years, all private banks I know classify ALL bearer share PICs 
as high risk." 1594 

In June 2007, Mr. Kazmy sent a draft "Job Aid" on bearer shares to the IPB offices with 
bearer share accounts. 1595 HBUS Job Aids were documents designed to provide more specific 
instructions to bank personnel in implementing higher level policies and procedures. 159 Mr. 
Kazmy immediately met strong resistance to strengthening the AML controls on bearer share 
accounts. 

Teresa Garcia, who was a senior Compliance officer at the New York IPB, criticized the 
draft on several grounds: for requiring all bearer share accounts to be classified as SCC accounts 
subject to enhanced due diligence and monitoring; requiring all shares to be held in the custody 
of the bank; and requiring beneficial ownership to be disclosed every two years. 1597 Ms. Garcia 
wrote that, although the Job Aid was similar to an existing policy at the New York IPB, the New 



1591 See 5/10/2010 email exchanges among OCC Joseph Boss, Lee Straus, James Vivenzio, Monica Freas, Sally 
Belshaw and others, "Bearer Share Accounts" OCC-PSI-00886601-606 (discussed further supra) . 

1592 See 2/26/2007 email exchanges among HBUS Ali Kazmy and HBUS Mary Caskin and others, "APC Interim 
Procedures," OCC-PSI-00307701 ("At present, we do not have a standard bearer share policy. I am actually 
working on it and expect it to be finalized this week, however it will require senior management approval."). 

1593 Id. 

1594 4/17/2007 email from HBUS Robert Guthmuller to HBUS Nerissa Hall and Alan Williamson, OCC-PSI- 
00211658. 

1595 6/18/2007 email from HBUS Ali Kazmy to HBUS Anne Liddy, "Job Aid - Bearer Share," OCC-PSI-00617514. 

1596 Subcommittee interview of Ali Kazmy (2/29/2012). 

1597 6/18/2007 email from HBUS Ali Kazmy to HBUS Anne Liddy, "Job Aid - Bearer Share," OCC-PSI-00617514. 
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York IPB did not classify bearer share accounts as SCCs unless the nature of the beneficial 
owner warranted it, and bearer certificates could be held with a third party custodian instead of 
the bank. Ms. Garcia added that the Job Aid should only require beneficial ownership disclosure 
forms to be renewed every three years. Later that day, Ms. Garcia sent another email to Mr. 
Kazmy and others stating: "IPB-NY has about 500 non-high risk bearer share accounts. There is 
no way we are making all these accounts SCCs." 1598 These emails, in which Ms. Garcia opposed 
the proposed AML controls, show that she saw her role in this instance as acting on behalf of the 
business unit rather than acting on behalf of HBUS Compliance. 

The Miami office was also critical of the proposed Job Aid. Clara Hurtado, Director of 
AML Compliance for Miami, wrote: 

"Miami also has a large number of bearer share accounts. I too disagree with making 
these SCCs. We are also getting an updated BOL [Beneficial Ownership Letter] every 3 
years, not 2 years. Before anything goes out to the units, we need to be careful that we do 
not change the agreed upon policies/procedures which have been put in place based on 
local regulator requirements." 1599 

On July 25, 2007, Ms. Hurtado sent Mr. Kazmy another email stating that Miami had 
approximately 600 bearer share accounts and they "could not possibly categorize them all as 
high risk." 1600 She proposed instead that Miami use the bearer shares as one indicator of a high 
risk account, but that a second indicator would also have to be present before the account would 
be classified as high risk and subjected to enhanced due diligence and monitoring. She wrote: 
"We feel this is a good way to capture truly high risk bearer share accounts." Ms. Hurtado also 
asserted that there was "no way to custodize in Miami and remotely was too difficult." 1601 She 
proposed instead that Miami maintain its current practice of requiring a Beneficial Ownership 
Letter for new accounts with updates every three years. She noted that the Miami policy had just 
been approved by HBUS Compliance head Teresa Pesce and Compliance Officer of California 
Programs, Susan Hoggarth, both of whom had agreed that Miami would not have to custodize 
the shares. 1602 These emails show that Ms. Hurtado, like Ms. Garcia, saw her role in this 
instance as defending the position of the international private bank rather than the position of 
HBUS Compliance. 

Four days later, on July 29, 2007, Ms. Hurtado sent Mr. Kazmy another email suggesting 
that the AML Director rather than the CEO should be able to approve the opening of bearer share 
accounts. She also wrote that the Miami subsidiary "will not be lowering the monitoring 
thresholds on over 600 bearer share accounts," and that Miami's use of Beneficial Ownership 
Letters had been approved by HBUS Corporate Compliance and the office "cannot go back and 
re-paper." 1603 The next day, Ms. Hurtado forwarded Mr. Kazmy a copy of the Miami bearer 
share procedures, explaining that if he wanted to change them, he would need to "reach out to 



1598 Id. 

1599 Id. 

1600 7/25/2007 email from HBUS Clara Hurtado to HBUS Ali Kazmy and others, "Bearer Share Meeting," OCC- 
PSI-00217164. 

1601 Id. 

1602 Id. 

1603 Id. 
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the business first," and gave him contact information for Jeff Clous, head of HBUS IPB 
Operations in Florida. 1604 

On August 6, 2007, Mr. Kazmy forwarded Ms. Hurtado's emails to two more senior 
HBUS AML Compliance officials, Alan Williamson and Anne Liddy. Though Mr. Williamson 
had agreed that IPB Miami should be included in the new policy, he said after reading Ms. 
Hurtado's emails, "unfortunately I now question my prior inclination to make them be 
consistent." 1605 Mr. Williamson suggested that the new guidance be prospective from the date of 
issuance so that the bank would not have to do a retrospective review of bearer share accounts, 
stating that "may be a good idea but we should avoid locking ourselves in." Mr. Williamson also 
recommended adding an "exception process" in the policy, because there is "always a special 
case somewhere." 1606 Mr. Kazmy replied that the bank may have to do a retrospective review 
over a reasonable time period, but agreed to include the following line in the policy: "Exceptions 
to this Policy must be sought from the AML Director or designee in writing giving full details of 
the matter warranting such exception. The written approval must be maintained in customer file 
and reported to Oversight & Control Group upon receipt." 1607 In August 2007, the New York 
IPB policy for bearer shares was slightly strengthened. It required all new clients wishing to 
open a bearer share account to obtain approval from the New York IPB CEO and AML Local 
Compliance Officer, and further required them to register or custodize their shares. 1608 This 
policy essentially treated all new bearer share accounts as high risk, though no mention was 
made of enhanced due diligence or monitoring obligations. Existing bearer share accounts were 
kept divided into high and low risk accounts. High risk bearer share accounts were required to 
register or custodize their shares. Low risk bearer share accounts were allowed to provide a 
Beneficial Ownership Letter every three years, and their shares were not taken into custody. 1609 
At this time HBUS New York held over 630 bearer share accounts. 1610 

American Express Prosecution. On August 6, 2007, the U.S. Justice Department, 
working with the Federal Reserve and FinCEN, filed a Deferred Prosecution Agreement against 
American Express Bank International for criminal violations of federal AML laws. 1 11 In 
August 2007, HBUS Compliance circulated information about the prosecution, not because 
HBUS had participated in any of the matters involving American Express, but to alert 



1604 8/6/2007 email exchange among HBUS Ali Kazmy, HBUS Alan Williamson, HBUS Clara Hurtado and others, 
"miami bearer share procedures," OCC-PSI-00217163. 

1605 8/9/2007 email exchanges among HBUS Ali Kazmy, HBUS Alan Williamson, and HBUS Anne Liddy, "On 
Boarding Bearer Share Corporation Policy Guidance," OCC-PSI-003 16956. 

1606 8/6/2007 email exchanges among HBUS Ali Kazmy, HBUS Alan Williamson, and HBUS Anne Liddy, "On 
Boarding Bearer Share Corporation Policy Guidance," OCC-PSI-00217148 

1607 Id. 

1608 8/ 27/2007 email exchanges among HBUS Alan Williamson, HBUS Terry Westren and others, "OCC-PSI- 
003 18438 

1609 Id. 

1610 2007 List of New York Bearer Share Accounts, OCC-PSI-003 18439. 

1611 United States v. American Express Bank International , Case No. 07-20602-CR-ZLOCH/SNOW (USDC SD 
Flor.), Deferred Prosecution Agreement (8/7/2007). 

1612 8/9/2007 email exchanges among HBUS Ali Kazmy, HBUS Alan Williamson, and HBUS Anne Liddy, "On 
Boarding Bearer Share Corporation Policy Guidance," OCC-PSI-003 16956. 

1613 8/7/2007 email exchanges among OCC HBUS Daniel Jack, HBUS Alan Williamson and others, "AML 
Enforcement Actions vs AmEx (Banknotes & Metals)" OCC-PSI-002 17241. 
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employees to the prosecution, ascertain if any of the American Express clients were also clients 
of HBUS, and point out that the Deferred Prosecution Agreement had targeted the bank in part 
for lack of sufficient AML controls over bearer share accounts. 1614 

In response, on August 16, 2007, Jeff Clous, head of HBUS IPB Operations in Florida, 
expressed concern to Alan Williamson of HBUS Compliance about HBUS' relative dearth of 
AML compliance resources compared to American Express, which had twelve full time 
compliance staff. He wrote: "I believe we have resource constraints that impact our AML 
program that need to be addressed." 1615 

The next day, on August 17, 2007, HBUS Compliance head Carolyn Wind and Alan 
Williamson met with Federal Reserve officials. During this meeting, described by HBUS as 
"friendly," the Federal Reserve referenced the American Express case, suggested HBUS might 
have similar issues, and suggested the HBUS Miami management and compliance teams take 
another look at risky products, such as bearer share companies. 1616 In a summary of the meeting, 
Ms. Wind noted that one Federal Reserve employee commented with respect to HBUS: "if you 
take the facts from the American Express case and lay them over our last report of HSBC, they 
are all there." 1617 Earlier in the year, on January 24, 2007, the Federal Reserve had issued a 
Report of Examination for the Miami IPB which included a requirement that management 
"enhance the current controls over bearer share accounts to ensure that they are sufficiently risk- 
based and capable of detecting changes in ownership of these entities on an ongoing basis." 

That same month, HBUS Compliance began conducting a "gap analysis" comparison of 
the American Express case versus its own AML program. On October 11, 2007, the analysis was 
issued and identified bearer shares as a particular concern at both American Express and 
HBUS. 1619 It also announced the decision by HBUS to stop opening new bearer share accounts 
as of September 1, 2007, and to consider also eliminating all of its existing bearer share 
accounts: 

"AEBI [American Express Bank International] failed to exercise sufficient control over 
accounts held in the names of offshore bearer share corporations, and until 2004 had 



1614 8/7/2007 email exchanges among HBUS Daniel Jack, HBUS Michael Baez, HSBC/IBEU Gordon Brown, 
HBMD Sally Lomas, HBUS Michael Karam and others, "AML Enforcement Action against AmEx businesses," 
OCC-PSI-00153253. On August 9, 2007, Ali Kazmy wrote, "At this juncture, your cognizance is drawn to the 
recently issued enforcement action against American Express entities, who were penalized up to $55 million for 
BSA/AML violations including those associated with PICS/bearer share accounts." 8/09/2007 email from Ali 
Kazmy to Alan Williamson, OCC-PSI-003 16956. 

1615 8/20/2007 email exchanges among HBUS Alan Williamson, HBUS Camillus Hughes and others, "AEBI 
Deferred Prosecution Agreement," OCC-PSI-002 18380. 

1616 8/23/2007 email exchanges among HBUS Marlon Young, HBUS Carolyn Wind, HBUS Louis Marino, HBUS 
Jeff Clous and others, "File Note on Meeting with Federal Reserve Bank of Atlanta," OCC-PSI-00698461. 

1617 Id. 

1618 1/24/2004 Board of Governors of the Federal Reserve System "Report of Examination of Edge Corporation," 
OCC-PSI-00388 1 10. 1/24/2004 Board of Governors of the Federal Reserve System "Report of Examination of 
Edge Corporation," OCC-PSI-00 107432. 

1619 10/1 1/2007 "High Level Comparison of Key Anti-Money Laundering Program Deficiencies Identified at 
American Express Bank international," prepared by Alan Williamson and Stefan Hardy, OCC-PSI-00221959. 
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no policy or procedure requiring beneficial owners of such accounts to certify in writing 
their continued ownership of the bearer shares. 

Bearer share accounts are known and HSBC requires written confirmation every three 
years. A decision has been taken by the business not to accept new bearer share 
accounts beginning 9/1/07. Management is considering a program to eliminate all 
bearer share customers." 1620 



Although HBUS announced a ban on opening new bearer share accounts as of September 1, 
2007, it issued a new bank- wide bearer share policy three months later allowing new accounts. 

Final Bearer Shares Policy. On December 10, 2007, HBUS Compliance officer Paul 
O' Sullivan circulated a final draft of the proposed new Bearer Share Policy. He explained that 
the policy was more flexible than first proposed, and "we will be able to maintain Bearer Share 
Company accounts once the requirements of the policy are met." 1621 The draft policy applied to 
both new and existing bearer share accounts. It required all bearer share accounts to either 
register their shares or keep the shares in custody with the bank or an approved third party. In 
addition, Beneficial Ownership Letters would have to be filed every three years. The draft 
policy also permitted new accounts to be opened if they were approved by the Business Unit 
head, AML Local Compliance Officer, and AML Director, or a designee. The approvals would 

1 699 

have to be documented and retained in the customer file. 



On December 11, 2007, HBUS Compliance officer Terry Westren responded as follows: 

"If I read this correctly, it is saying that one year from the issuance of this policy, we 
have to have all outstanding bearer shares (currently with clients), either registered or in 
the hands of an approved Custodian. Is this correct? I recall when the OCC was here, 
they asked for this. AML Compliance was able to negotiate for this requirement to be 
applicable only to High Risk accounts. We then complied with this. It looks like this is 
now expanded to all outstanding bearer shares? Of course, with the new BVI rules 
coming into play in 2009, they will have to do this anyway, but I think it should be noted 
this could be a considerable exercise." 1623 



Contrary to the statement in this email, however, the 2006 OCC Supervisory Letter had already 
called for the bank to place all bearer shares in the custody of either the bank or an acceptable 
third party, with no exceptions made for lower risk accounts. 1624 While HBUS had responded to 
the Supervisory Letter that it planning to limit that requirement to higher risk accounts, there is 



Id. (Emphasis in original.) 

1621 12/10/2007 email exchanges among HBUS Paul O'Sullivan, HBUS Terry Westren, HBUS Mason Salit, HBUS 
Tereso Suarez-Obregon and others, "Bearer Share Corporation Policy," OCC-PSI-00226525. 

1622 8/ 29/2007 Bearer Share Corporation Account "Policy Guidance," OCC-PSI-00226526. 

1623 12/1 1/2007 email exchanges among HBUS Terry Westren, HBUS Paul O'Sullivan and others, "Bearer Share 
Corporation Policy," OCC-PSI-00327917. 

1624 See 1/31/2006 OCC Supervisory Letter, "International Private Banking BSA/AML Examination," OCC-PSI- 
00000317. [Sealed Exhibit.] 1625 Subcommittee interview of Joseph Boss (1/30/2012) and James Vinenzio (3/ 
/2012). See also 5/10/2010 email exchanges among OCC Joseph Boss, Lee Straus, James Vivenzio, Monica Freas, 
Sally Belshaw and others, "Bearer Share Accounts" OCC-PSI-00886601-606. 
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no documentation showing the OCC accepted that position. When asked about this email, the 
OCC told the Subcommittee it had been under the impression that HBUS had closed all of its 
bearer share accounts. 1625 

That same day, December 11, 2007, Jeff Clous, IPB Operations head in Florida, repeated 
the concerns he had voiced to Alan Williamson in September. Mr. Clous asserted that the draft 
policy would have an adverse effect on IPB business. He noted that, although IPB Miami was 
no longer opening new bearer share accounts, it still maintained 1,679 accounts with $2.6 billion, 
which generated $26 million in revenue annually. Mr. Clous also asserted that the draft policy 
went too far beyond what regulators required. He noted that the proposed policy required the 
bank to both register and custodize bearer share accounts, while the federal AML examination 
manual offered a choice between those options. In addition, he noted that the draft policy would 
require existing bearer share accounts to register or custodize their shares by the end of 2008, 
even though the new BVI bearer share regulations would not require the registration of BVI 
bearer shares until the end of 2009. 1626 

On December 14, 2007, the HBUS Board of Directors approved its first HBUS-wide 
Bearer Share Policy. The bearer share policy applied to all new and existing bearer share 
accounts and required the client to register the shares or agree to hold the shares in custody with 
HSBC or a third party custodian and provide a periodic beneficial ownership certificate. 
AML Director Leslie Midzain gave both IPB New York and Miami IPB a full year, until 2009, 
to comply with the policy due to the BVI registration project which had a 2009 deadline. 1629 For 
the next year, New York IPB and Miami IPB continued to follow their own policies and 
procedures with regard to bearer share accounts. 

Federal Reserve Concern. In 2008, an HSBC Group Audit of the New York IPB 
disclosed that it had 610 bearer share accounts, 31 of which had overdue Beneficial Ownership 
Letters, including 21 which were overdue by more than a year. 1630 In Miami, an earlier HSBC 
Group Audit disclosed that, as of October 2007, the Miami IPB had 1,667 bearer share accounts, 
1,109 or two-thirds of which had Beneficial Ownership Letters that were more than three years 
old and so were overdue to get new letters. 1631 Both audits indicated that HBUS was at risk of 
not knowing, in many cases, who owned the corporations behind the bearer share accounts. 



1625 Subcommittee interview of Joseph Boss (1/30/2012) and James Vinenzio (3/ /2012). See also 5/10/2010 email 
exchanges among OCC Joseph Boss, Lee Straus, James Vivenzio, Monica Freas, Sally Belshaw and others, "Bearer 
Share Accounts" OCC-PSI-00886601-606. 

1626 12/1 1/2007 email from HBUS Jeff Clous to HBUS Paul O'Sullivan and others, "Bearer Share Corporation 
Policy," OCC-PSI-00226652. 

1627 August 29, 2007 Bearer Share Corporation Account Policy Guidance, OCC-PSI-00226526. 

1628 August 29, 2007 Bearer Share Corporation Account Policy Guidance, OCC-PSI-00226526. 

1629 See 4/18/2008 HBUS KYC Committee Meeting minutes, OCC-PSI-00241046. See also 7/3/2008 memorandum 
from HBUS Ali Kazmy to HBUS Leslie Midzain, OCC-PSI-00292367 ("Since BVI authorities have granted till 
December 2009 for all bearer shares to be registered, all BVI bearer share corporations within PB Americas will 
follow this time frame."). Subcommittee briefing by HSBC legal counsel (7/9/2012). 

1630 10/2008 Group Financial Services Audit October 2008, OCC-PSI-00248215. 

1631 See 10/2007 "HSBC Group Financial Services and European Audit Report on HSBC Private Bank International 
, Miami and HBUS Domestic Private Banking- Florida Region," OCC-PSI-00223637; see also 12/1 1/2007 HSBC 
Private Bank International FSA Audit Issues Status Report, OCC-PSI-00226813. 
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On January 31, 2008, HBUS AML Compliance officer Paul O'Sullivan emailed Clara 
Hurtado, Compliance officer for the Miami IPB, regarding a "De-Risking Strategy for 
Miami." 1632 He also discussed with HBUS Compliance head Carolyn Wind and senior AML 
Compliance officer Alan Williamson the Federal Reserve's concerns regarding the high-risk 
nature of the Miami IPB's client-base. 1633 Mr. O'Sullivan asked Ms. Hurtado to identify the 
high risk bearer share accounts for which there was no "glue to cement the relationship" and 
consider terminating them. 1634 

Six months later, on June 12, 2008, the Federal Reserve issued its annual Report of 
Examination (ROE) for the Miami IPB. The ROE again identified bearer share accounts as a 
problem, this time expanding the recommended action to be taken and noting, in particular, that 
ownership of a bearer share account should be ascertained more frequently than every three 
years: 

"Assess the risks associated with bearer share accounts and establish risk mitigation 
control measures that are appropriate for the associated level of risk. These control 
measures may include maintaining control over bearer share accounts; entrusting bearer 
share accounts with a reliable second party; or requiring periodic certification of 
ownership. At a minimum, management should conduct a review of the bearer share 
recertification policy and ensure that accounts that pose higher risks are recertified more 
frequently than every three years." 

On June 25, 2008, Peter Georgeou, deputy head of Group Audit Private Bank, emailed 
the head of HSBC Group audits, Matthew King, addressing the latest Federal Reserve 
examination report. While the Federal Reserve had listed 13 required actions, Mr. Georgeou 
alerted Mr. King to those he considered "more material." On his list was: "Improved controls 
and risk mitigation are required in respect of bearer share accounts and accounts held in the name 
of PICs. In addition, policies and procedures should be enhanced for identification and the 
review of higher risk accounts." 1636 

On July 3, 2008, HBUS Compliance officer Ali Kazmy sent a memorandum to HBUS 
Compliance and AML head Lesley Midzain summarizing changes that had been made to the 
IPB's AML Procedures for 2007 and 2008. He noted that BVI bearer shares would have to be 
registered by December 2009, in accordance with the time frame set forth by BVI authorities. 
He wrote that high risk bearer share accounts would also require annual recertification of 
beneficial owner information, while lower risk bearer share accounts would need to recertify 
beneficial ownership every three years. In addition, he wrote that bearer share clients would be 



1632 1/31/2008 email from HBUS Paul O'Sullivan to HBUS Alan Williamson and HBUS Carolyn Wind, "De- 
Risking," OCC-PSI-00331923. 

1633 When asked about the 1 167 bearer share accounts, Ms. Wind told Subcommittee that she knew there were bearer 
share accounts, but did not know there were that many. She said she had talked about getting rid of bearer share 
accounts and wanted tighter controls. She also said longstanding bank clients with bearer share accounts were not 
uncommon in private banking. Subcommittee interview of Carolyn Wind (3/7/2012). 

1634 Id. 

1635 6/12/2008 Federal Reserve Audit, at 10-11. 

1636 7/2/20O8 email exchanges among HBUS Janet Burak, HBUS Bob Martin and others, "Federal Reserve Bank of 
Atlanta Review of HSBC Private Bank Miami," HBUS OCC-PSI-00725897. 
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required to attest that they will notify the bank if a change in ownership occurs and provide a 
new Beneficial Ownership Letter. 16 7 The next day, July 4, 2008, Jeff Clous, head of IPB 
Operations in Florida, repeated the concerns he had voiced twice before, to Alan Williamson and 
Paul O'Sullivan. 1638 



On November 12, 2008, the New York International Private Bank sought dispensation to 
open 80 new bearer share accounts for existing clients. 1639 New York IPB employee Todd 
Maddison asked senior HBUS Compliance officer Alan Williamson whether Compliance would 
provide the needed dispensation. 1640 Mr. Maddison said that he thought that an email written by 
Teresa Garcia, which outlined exceptions to the bearer share policy for the Private Bank, implied 
that the accounts could be opened under these exceptions: 

"Since BVI authorities have granted till December 2009 for all bearer shares to be 
registered, all BVI bearer share corporations within PB Americas will follow this time 
frame; High risk bearer share accounts will provide an annual recertification of the 
beneficial owners through a properly executed BOL; Standard risk bearer share accounts 
will provide beneficial ownership recertification every three years through a properly 
executed Beneficial Ownership Letter (BOL); and Clients must attest that they will notify 
the bank of change in ownership, as and when it takes place. A new BOL will be required 
from the new beneficial owner." 1641 

Some of the 80 new bearer share brokerage accounts were opened and some of them, as 
well as some other New York IPB bearer share accounts, were later moved to the Miami 
IPB. 1642 0n March 18, 2009, the OCC issued a Supervisory Letter addressing AML concerns 
related to the HBUS Private Banking operations. The letter indicated that one of the OCC's 
primary examination objectives was to "[e]valuate effectiveness of enhancements to policies and 
procedures for PUPID activities, bearer share accounts and monitoring processes." 1643 Despite 
this objective, the letter did not address bearer share issues in its conclusions or 
recommendations. 1644 The OCC's silence on the issue stands in sharp contrast to the Federal 
Reserve which was not only aware of the bearer share accounts, but tracking actions taken in 
Miami with respect to them. 



7/3/2008 memorandum from HBUS Ali Kazmy to HBUS Lesley Midzain, "Modifications to the Approved 
Private Bank Americas AML Procedures," OCC-PSI-00292367. 

1638 10/29/2008 email exchanges among HBUS Alan Williamson, HBUS Lesley Midzain and others, "Enquiry - co- 
branding," OCC-PSI-00219656. 

1 39 11/14/2008 email exchanges among HBUS Todd Maddison, HBUS Alan Williamson and others, "Bearer share 
question," OCC-PSI-00248782. HBUS legal counsel told the Subcommittee that 80 of its clients with bearer shares 
needed to open brokerage accounts due to a regulatory change. Subcommittee briefing by HBUS legal counsel 
(7/9/2012). 

1640 j 1/14/20O8 email exchanges among HBUS Todd Maddison, HBUS Alan Williamson and others, "Bearer share 
question," OCC-PSI-00248782. HBUS legal counsel told the Subcommittee it did not know whether or not a 
dispensation was granted for these accounts. Subcommittee briefing by HBUS legal counsel (7/9/2012). 

1641 11/14/2008 email exchanges among HBUS Todd Maddison, HBUS Alan Williamson and others, "Bearer share 
question," OCC-PSI-00248782. 

1642 Subcommittee briefing by HSBC legal counsel (7/9/2012). 

1643 3/18/2009 supervisory letter from OCC to HBUS Leslie Midzain, "Private Banking BSA/AML Examination," 
OCC-PSI-00000445-447, at 445. 

1644 See 5/10/2010 email from OCC Joseph Boss to OCC Lee Straus, James Vivenzio, Monica Freas, Sally Belshaw, 
and others, "Bearer Share Accounts," OCC-PSI-00886601. 
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On May 19, 2009, the Federal Reserve issued its annual Report of Examination for the 
Miami IPB, which again mentioned bearer shares as a concern. It stated in part: 

"[T]he risks posed by the international private banking activities remain significant, given 
the high transactional nature of the client base, a higher risk target market (Latin 
America), and the existence of offshore shell companies (including offshore operating 
companies), including bearer share structures." 164 

The examination report continued that the risk was increasing due to the bank's transfer of some 
accounts from the New York International Private Bank to the Miami Edge Corporation. The 
report also noted that HBUS had taken steps to address the risk. It noted that senior compliance 
personnel had sought to "de-risk" the Miami IPB's private banking activities, primarily by: 

"continued review of offshore operating shell companies, seeking to exit those 
relationships where the profitability of the relationships does not justify the additional 
compliance costs associated with the account. This strategy, coupled with increased 
approval requirements for new operating company accounts, and a decision to no longer 
open new bearer share accounts, shows tangible steps taken towards reducing 
reputational risk at Corporation." 1646 

This was the third Report of Examination over a two year period to have directed HBUS to 
strengthen its AML controls over its bearer share accounts. 

2009 Bearer Share Project. In February 2009, HBUS began the "Bearer Share Project" 
with the goal of winding down HBUS' bearer share accounts. 1647 Because the British Virgin 
Islands (BVI) had passed legislation that would require bearer share certificates to be registered 
or custodized by the end of the year, HSBC viewed this development as an indication that other 
laws would soon be passed and decided that it would begin registering or custodizing its bearer 
shares beginning with the accounts opened by BVI bearer share corporations. 1648 By 2009, 
HBUS' international private banks operated under a new organizational structure called Private 
Bank Americas (PBA), and the bearer shares were treated as a group. PBA determined that it 
had a total of 1833 unregistered bearer share accounts, including 1257 BVI bearer shares and 576 
non-BVI bearer shares. It determined that 306 were in the New York Private Bank and 1527 
were in the Miami Private Bank. 1649 The Project began with HBUS' sending a letter to all of its 
BVI bearer share clients in May 2009. 1650 The letter explained that as of December 31, 2009, 
HBUS would "no longer maintain accounts for companies that issue bearer shares." It indicated 
that clients would need to register their bearer shares or close their accounts. 1651 



1645 5/19/2009 Federal Reserve Report of Examination of Edge Act Corporation, BOG-A-300035. [Sealed Exhibit.] 

1646 Id. at 21. 

1 7 Subcommittee briefing by HSBC legal counsel on bearer share issues (4/20/2012 and 7/9/2012). 

1648 Id. 

1649 Id. 

1650 Letter from HBUS to British Virgin Islands bearer share clients, "For Companies Incorporated in the British 
Virgin Islands," HSBC-PSI-PROD-0197129-133; Subcommittee briefing by HSBC legal counsel (7/9/2012). 

1 51 Letter from HBUS to British Virgin Islands bearer share clients, "For Companies Incorporated in the British 
Virgin Islands," HSBC-PSI-PROD-0197129-133, at 129. 
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In 2010, the OCC, which had been silent on bearer share issues at HBUS for four years, 
renewed its focus on the accounts. On May 10, 2010, one of the OCC AML examiners sent an 
email to EIC Sally Belshaw, OCC attorneys in Washington and others stating that HBUS 
Compliance head Terry Pesce had told him that all but one bearer share account had been closed 
in 2006. 1652 One of the OCC attorneys in Washington wrote in an email that he recalled that the 
examiner "had been told" that there were no bearer share accounts. 1653 The AML examiner 
indicated that he had just learned that HSBC still had 79 bearer share accounts held in Panama, 
Uruguay, Bahamas, Cayman, Belize, and Netherlands. 1654 In June 2010, another OCC examiner 
at HBUS obtained a list from HBUS of 1 17 bearer share accounts. 1655 On September 8, 2010, 
the same examiner forwarded a portion of a May 2010 New York IPB report stating it had 610 
bearer share accounts, 31 of which had overdue beneficial ownership declarations. 1656 The 
report also indicated that, for some accounts, the bank had no beneficial ownership declaration 
on file and no information about the location of some of the shares. Later that same day, the 
examiner sent another email with a copy of an audit of the Miami IPB indicating it had 925 
bearer share accounts, in addition to the 610 accounts in New York. 1657 The examiner agreed to 
forward the Miami audit report to the Federal Reserve. 1 8 These internal communications 
indicate that a primary reason for OCC inaction on bearer share issues was a misimpression that 
the accounts had been closed four years earlier. 1659 It also indicates a lack of coordination with 
the Federal Reserve which had been monitoring the bearer share issue in Miami for several 
years. 

By the time the OCC became aware of the large number of bearer share accounts still 
open at HBUS, the Bearer Share Project was well underway in its efforts to reduce the account 
volume. Having already sent a 2009 letter to accountholders with BVI bearer share corporations 
about the need to register their shares or close their accounts, HBUS followed in November 
2010, by sending a similar letter to all accountholders with non-BVI bearer share corporations. 



See 5/10/2010 email from OCC Joseph Boss to OCC Lee Straus, James Vivenzio, Monica Freas, Sally Belshaw, 
and others, "Bearer Share Accounts," OCC-PSI-00886601. 

1653 9/3/2010 email exchanges among OCC James Vivenzio and OCC Teresa Tabor, "Bearer Share Accounts," 
OCC-PSI-00894871. 

1654 See 5/10/2010 email from OCC Joseph Boss to OCC Lee Straus, James Vivenzio, Monica Freas, Sally Belshaw, 
and others, "Bearer Share Accounts," OCC-PSI-00886601. 

1655 6/15/2010 email from OCC Teresa Tabor to OCC Joseph Boss, [no subject], OCC-PSI-00929779 and 
attachment OCC-PSI-00929780 

1656 9/3/2010 email exchanges among OCC James Vivenzio and OCC Teresa Tabor, "Bearer Share Accounts," 
OCC-PSI-00894871. 

1657 6/15/2010 email from OCC Teresa Tabor to OCC Joe Boss forwarded to OCC Elsa De La Garza, [no subject], 
OCC-PSI-00929779 and attachment OCC-PSI-00929780. 

1658 9/8/2010 email exchanges among OCC Teresa Tabor and OCC Joseph Boss, "IPB Miami (Edge)," OCC-PSI- 
00921759-760, at 759. 

1659 See also 5/12/201 lconclusion memorandum from OCC Teresa Tabor to OCC Kerry Morse, "Latin American 
International Center (LAIC) Miami - BSA/AML Examination," OCC-PSI-01768568 (finding that LAIC had two 
bearer share accounts which "only came to the attention of the LAIC Compliance Staff based on Examiner inquiries 
at the commencement of the examination"; and that LAIC had not fully followed HBUS bearer share policy for 
these two accounts because Beneficial Ownership Letters were not obtained every three years and the shares were 
being held by third-party custodians but it was unclear if the custodians had been approved by LAIC and what 
approval process was utilized). 
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By June 201 1, of the 1257 BVI bearer share accounts, 900 had registered their shares (so 
that the accounts no longer qualified as bearer share accounts) and 350 accounts had closed. 1660 
Of the 576 non-BVI bearer share accounts, 255 had registered their shares, and 182 accounts 
were closed. 1661 In November 201 1, Private Bank Americas froze the remaining 139 non-BVI 
bearer share accounts, and began working to contact the accountholders and close the 
accounts. 1662 



As of July 9, 2012, HSBC legal counsel told the Subcommittee that HBUS Private Bank 
America still had 26 bearer share accounts. HSBC legal counsel also told the Subcommittee 
that "all but a handful" of those accounts were frozen, because the accountholders had not 
registered their shares or closed their accounts. 1664 . According to HSBC legal counsel, the 
handful of bearer share accounts that were not frozen were beneficially owned by a single client, 
and the shares were being kept in the custody of a law firm in New York. HSBC legal counsel 
indicated that, although HBUS' latest bearer share policy continued to allow new bearer share 
accounts to be opened under limited circumstances, no new bearer share account had, in fact, 
been opened since that policy took effect. 1665 Internal HBUS documents indicate that as a result 
of the Bearer Share Project, on at least two occasions, the bank identified suspicious activity 
related to the accounts. 666 



C. Two Examples of Bearer Share Accounts 



Two examples of bearer share accounts illustrate the AML risks they pose. They involve 
bearer share accounts opened by Mauricio Cohen Assor and Leon Cohen Levy, which 
demonstrate how bearer share accounts can be used to conceal assets and evade taxes; and a 
wealthy Peruvian family, which demonstrates how banks can be pressured to waive AML 
safeguards when opening bearer share accounts. 

Cohen Bearer Share Accounts. Mauricio Cohen Assor and Leon Cohen Levy, father 
and son, were hotel developers in Miami Beach. 1667 On April 14, 2010, both were indicted in 
Florida on charges of conspiring to commit tax fraud and filing false tax returns. The Justice 
Department charged that the Cohens had used bearer share corporations and shell companies to 
help conceal $150 million in assets and $49 million in income from the IRS. Both resided in 
Miami Beach, Florida. 



Subcommittee briefing by HSBC legal counsel on bearer share issues (4/20/2012). 

1661 Id. 

1662 Id. 

1663 rp ne Subcommittee was told that 12 of accounts are located in Miami and 14 are located in New York. 
Subcommittee briefing by HSBC legal counsel on bearer share issues (7/9/2012). 

1664 w 

1665 Briefing by HSBC legal counsel to the Subcommittee on bearer share issues (4/20/2012). 

1666 See 5/6/2010 AML Oversight Committee Meeting minutes for HBUS, OCC-PSI-00860859-860, at 859. 

1667 io/7/2010 "Miami Beach Hotel Developers Convicted of Tax Fraud," Department of Justice press release, 
http://www.justice.gov/usao/fls/PressReleases/101007-01.html. 

1668 See generally United States of America v. Mauricio Cohen Assor and Leon Cohen Levy . Case No. 10-60159- 
CR-ZLOCH(s) (USDC SD Flor.), Superseding Indictment (8/3/2010) (hereinafter "Cohen Indictment"). See also "2 
Charged in Tax Evasion Scheme Involving HSBC," New York Times , http://dealbook.nytimes.com/2010/04/16/2- 
charged-in-tax-evasion-scheme-involving-hsbc/. 
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The indictment explained that "bearer share corporations are often set up in tax havens to 
hide the true ownership of assets, because ownership records are not maintained and nominee 
officers and directors are often used to appear to control the affairs of the corporation." 1669 

The indictment named two bearer share corporations used by the Cohens to open bank 
accounts, Blue Ocean Finance Ltd., a Panamanian bearer share corporation, 1670 and Whitebury 
Shipping Time Sharing Ltd., a BVI bearer share company. 1671 The Cohens used those bank 
accounts to conceal their ownership of the assets deposited into them. The indictment also 
disclosed that, around May 2007, an unnamed international bank asked one of the Cohens to 
register the shares of Whitebury Shipping and, when the request was refused, the bank closed the 
account. 

Internal bank documents disclose that HBUS was the unnamed bank that maintained a 
bearer share account for Whitebury Shipping. April 2007 transcripts of several telephone 
conversations between Mauricio Cohen and an HBUS banker describe the account, HBUS' 
request that he register the bearer shares, and his refusal to do so. According to one of the 
telephone transcripts, on April 23, 2007, HBUS executive Claude Mandel, the Relationship 
Manager who handled the bank's relationship with Mauricio Cohen, apparently agreed to 
remove Mr. Cohen's name from the Whitebury account. 1672 The next day, Mr. Cohen talked to 
Mr. Mandel about replacing Whitebury with another bearer share account. Mr. Mandel offered 
to convert Whitebury from a BVI to a Bahamian bearer share corporation, but said that the bank 
no longer opened bearer share accounts. Mr. Cohen protested and told Mr. Mandel that the bank 
would lose clients and that other banks take bearer share accounts. 1673 The telephone transcripts 
indicate that, on April 25, 2007, Mr. Mandel and Mr. Cohen again discussed Mr. Cohen's bearer 
share accounts. Despite Mr. Mandel' s insisting that his bearer shares would need to be 
registered, Mr. Cohen convinced Mr. Mandel to check if he could convert Whitebury into a 
Panamanian bearer share corporation. Mr. Cohen indicated again that he did not want to put 
names on the shares; when Mr. Mandel said that the shares would need to state the names, Mr. 
Cohen said: "But, I can't put that, otherwise I have to declare them in the United States? I can't 
do that, I don't want to declare . . . otherwise, I have to close the accounts with you and go to 
Geneva." 1674 

Minutes from a May 6, 2010 AML Oversight Committee Meeting at HBUS noted that 
the HBUS Private Bank was providing information on closed bearer share accounts opened by an 
"ex-client" as part of the investigation of Mauricio Cohen, a former HSBC client. 



16W Cohen Indictment at 3. 

1670 Id. at 7. 

1671 Id. at 8. 

1672 Transcript of 4/23/2007 telephone conversation between HBUS Claude Mandel and Mauricio Cohen, HSBC- 
PSI-PROD-003089 1-894. 

1673 Transcript of 4/24/2007 telephone conversation between HBUS Claude Mandel and Mauricio Cohen, HSBC- 
PSI-PROD-0030873-877. 

1674 Transcript of 4/25/2007 telephone conversation between HBUS Claude Mandel and Mauricio Cohen, HSBC- 
PSI-PROD-002479 1-793. 

1675 5/6/2010 HBUS AML Oversight Committee Meeting Minutes, OCC-PSI-00860859, at 859. 
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In October 2010, the Cohens were convicted after a jury trial, sentenced to ten years in 
prison, and ordered to pay back taxes, interest, and penalties totaling over $17 million. This 
example demonstrates the risk of bearer share accounts being used to conceal ownership of 
assets and commit criminal tax evasion. 

Peruvian Family Bearer Share Accounts. In 2007, a senior Compliance official with 
the HSBC Private Bank in New York, Teresa Garcia, sought a waiver to open a relationship for a 
Peruvian businessman for two bearer share accounts. According to Ms. Garcia, his business 
group was one of the richest and most powerful in Peru. 

The bearer share corporations, Urigeler International SA. - Holding Company and 
Birmingham Merchant S.A. - Holding Company, were formed in Panama. 1 7 According to an 
email exchange among HBUS Compliance personnel, in 2007, opening a new bearer share 
account required: (1) approval by the New York International Private Bank CEO and AML 
Local Compliance Officer; and (2) registration or custodization of the bearer shares. 1679 

Ms. Garcia wrote that she was requesting the waiver because the businessman had 
indicated that he did not want to forfeit confidentiality by registering or custodizing the bearer 
shares. 1680 She explained: "they wish to maintain confidentiality, and they have never been 
asked by our competitors with whom they bank to do this." 1681 Manuel Diaz, President and 
Managing Director of HSBC Private Bank International in Miami, indicated that he supported a 
waiver, because he was very familiar with the family and interested in establishing a relationship 
with them. Marlon Young, CEO of Private Banking Americas, also approved the waiver 

. 1683 

request. 

Ms. Garcia then escalated the request to senior HBUS Compliance official Alan 
Williamson to determine who had authority to grant the waiver on behalf of AML Compliance. 
Mr. Williamson explained that, while he had no objection to granting the waiver, the bearer 
shares policy was an HSBC Group mandate and any exception would have to be approved by 
HSBC Group Compliance. 1684 David Ford, HSBC Global Money Laundering Control Officer, 
confirmed that HSBC Group approval was required for an exception to Group policy. Mr. Ford 
also wrote that he was "[s]uprised can open bearer share account for offshore client with no bo 



1676 6/20/2007 email exchange among HBUS Teresa Garcia and HBUS Alan Williamson, "Waiver Request," OCC- 
PSI-00214516, at 3. 

1677 Id. at 3. 

1 78 6/20/2007 email exchange among HBUS Teresa Garcia and HBUS Alan Williamson, "Waiver Request," OCC- 
PSI-00214516, at 2. 
1679 Id. at 1. 

1 80 7/5/2007 email exchange among HBUS Teresa Garcia and HBUS Alan Williamson, Susan Hoggarth, and 
others, "[redacted] Family," OCC-PSI-0021521 1, at 6. 

1681 6/21/2007 email exchange among HBUS Alan Williamson and HBUS Marlon Young, Manuel Diaz, Teresa 
Garcia, and others, "Waiver Request," OCC-PSI-00214618, at 3-4. 

1682 6/20/2007 email exchange among HBUS Teresa Garcia and HBUS Alan Williamson, "Waiver Request," OCC- 
PSI-00214516, at 3. 

1683 6/25/2007 email from HBUS Marlon Young to HBUS Jaime Carvallo and others, "[redacted] Family," OCC- 
PSI-00214806. 

1684 6/21/2007 email exchange among HBUS Alan Williamson and HBUS Marlon Young, Manuel Diaz, Teresa 
Garcia, and others, "Waiver Request," OCC-PSI-00214618, at 3. 
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[beneficial ownership] declaration in US," and suggested checking with HBUS Compliance head 
Carolyn Wind about the OCC and Federal Reserve "view of such a structure." 1685 Mr. 
Williamson asked HSBC Group AML head Susan Wright about the request, and reported that 
she was reluctant to grant the exception but would consider it. 1686 

There was a strong push for this relationship by the business side. Manual Diaz, head of 
the Miami Private Bank International, wrote: "I FULLY SUPPORT THIS WAIVER." 1687 
Jaime Carvallo, a Miami bank executive, sent an email to the head of Private Banking Americas, 
Marlon Young, enlisting his support to obtain a waiver. Mr. Carvallo wrote: 

"Teresa Garcia must have given you heads up on the [redacted] family and the issue 
regarding their holding companies having bearer shares and the fact that they will not 
sign the BOL [Beneficial Ownership Letter]. 

I will see one of the family members tomorrow morning and this still seems to have no 
resolution. This is too important a family in Peru for us not to want to do business with, 
and one that has taken a lot of my time and effort to convince to start a relationship with 
us. ... I would appreciate your involvement at this point, as this has become extremely 

■■■ ,,1688 

sensitive. 

Mr. Young signaled his support for the waiver the same day, 1689 and later wrote to senior HBUS 
Compliance officer Alan Williamson: "This is an important relationship for IPB [International 
Private Bank] and a family that has a clean record. It would be a shame if we are not able to 
obtain an exception." 1690 Mr. Cavallo also wrote directly to Mr. Williamson that the family was 
"too important a family in Peru for us not to want to do business with." 1691 Mr. Carvallo 
estimated the family's liquid net worth, 1692 and explained that HSBC was currently competing 
with another bank to help the family reorganize their businesses and facilitate the succession of 
their financial assets and operating companies, which could be very profitable. 1693 



6/26/2007 email exchange among HBUS Alan Williamson and HBUS Jaime Carvallo, Marlon Young, Manuel 
Diaz, Teresa Garcia, and others, "[redacted] Family," OCC-PSI-00214880, at 1. 

1687 6/20/2007 email exchange among HBUS Alan Williamson and HBUS Manuel Diaz, Teresa Garcia, and others, 
"Waiver Request," OCC-PSI-00214534, at 1. 

1688 6/25/2007 email from HBUS Jaime Carvallo to HBUS Marlon Young and others, "[redacted] Family," OCC- 
PSI-00214806. 

1689 6/25/2007 email from HBUS Marlon Young to HBUS Jaime Carvallo and others, "[redacted] Family," OCC- 
PSI-00214806. 

1690 6/26/2007 email from HBUS Marlon Young to HBUS Alan Williamson and others, "[redacted] Family," OCC- 
PSI-00214891, at 1-2. 

1691 7/5/2007 email exchange among HBUS Teresa Garcia and HBUS Alan Williamson, Susan Hoggarth, and 
others, "[redacted] Family," OCC-PSI-0021521 1, at 6. 

1692 6/26/2007 email exchange among HBUS Alan Williamson and HBUS Jaime Carvallo, Marlon Young, Manuel 
Diaz, Teresa Garcia, and others, "[redacted] Family," OCC-PSI-00214880, at 1. 

1693 7/5/2007 email exchange among HBUS Teresa Garcia and HBUS Alan Williamson, Susan Hoggarth, and 
others, "[redacted] Family," OCC-PSI-0021521 1, at 5. 
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Mr. Williamson responded: "I thought so. I would do it without going to Geneva but 
audit wrote up DPB [Domestic Private Banking] on a similar situation." 1 94 Later, he wrote: "we 
will do our best." 1695 Still later: "Doing what I can." 1696 David Ford pointed out that the HSBC 
Group policy was flexible, because the client could either declare beneficial ownership, have 
HSBC hold the shares, or have an acceptable third party hold the shares. 1697 On July 5, 2007, Mr. 
Williamson wrote that the "RM [Relationship Manger] and the Group Head are not seeing eye to 
eye on this one." 1698 

In 2007, HBUS opened a bearer share account in the name ofUrigeler. 1699 When asked 
whether a waiver had been granted from the requirements that the bank hold the shares in 
custody and obtain an Beneficial Ownership Letter from the owner, HSBC legal counsel told the 
Subcommittee: "We don't know." 1700 HSBC legal counsel told the Subcommittee that the 
accounts was opened in New York, transferred to Miami in 2009, and closed in 2011. 1701 

This account demonstrates the difficulty of adhering to a strong bearer share policy when 
a wealthy and powerful family asks to open a bearer share account and obtain a waiver from 
requirements to either register the shares with their names or submit the shares to the custody of 
the bank. HBUS' bearer share policy continues to permit the bank to open bearer share accounts. 

D. Analysis 

For decades, bank regulators and AML experts have cautioned against opening accounts 
for bearer share corporations due to the ease with which these corporations hide ownership and 
the frequency with which they have been used to commit money laundering, financial crime, tax 
evasion, and other wrongdoing. From at least 2000 to 201 1, HBUS maintained a sizeable 
number of bearer share accounts, despite repeated regulatory questions and expressions of 
concern. HBUS bankers, and at times their compliance officers, pushed to open and maintain 
bearer share accounts. Two bearer share accounts illustrate the risks inherent in such accounts 
and the pressures to circumvent AML controls. While HBUS finally registered or closed most of 
the accounts by 201 1, its policy continues to allow bearer share accounts to be opened under 
some circumstances. 



1694 6/20/2007 email exchange among HBUS Alan Williamson and HBUS Manuel Diaz, Teresa Garcia, and others, 
"Waiver Request," OCC-PSI-00214534, at 1. 

1695 6/21/2007 email exchange among HBUS Alan Williamson and HBUS Marlon Young, Manuel Diaz, Teresa 
Garcia, and others, "Waiver Request," OCC-PSI-00214618, at 1. 

1696 6/26/2007 email from HBUS Alan Williamson to HBUS Marlon Young and others, "[redacted] Family," OCC- 
PSI-00214891, at 1. See also 7/5/2007 email exchange among HBUS Teresa Garcia and HBUS Alan Williamson, 
Susan Hoggarth, and others, "[redacted] Family," OCC-PSI-0021521 1; 6/26/2007 email exchange among HBUS 
Alan Williamson and HBUS Marlon Young, Manuel Diaz, Teresa Garcia, and others, "[redacted] Family," OCC- 
PSI-00214891. 

1697 7/5/2007 email exchange among HBUS Teresa Garcia and HBUS Alan Williamson, Susan Hoggarth, and 
others, "[redacted] Family," OCC-PSI-0021521 1, at 2. 

1698 Id. at 1. 

1699 Subcommittee briefing by HSBC legal counsel (7/9/2012). 

1700 Id. 

1701 Id. 
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VIII. OCC: EXERCISING INEFFECTIVE AML OVERSIGHT 

The mission of the Office of the Comptroller of the Currency (OCC) is to charter, 
regulate and supervise all U.S. banks that hold a national charter. 1702 To carry out that mission, 
in the words of the OCC, it conducts "regular examinations to ensure that institutions under our 
supervision operate safely and soundly and in compliance with laws and regulations," including 
AML laws. 1703 However, the HSBC case history, like the Riggs Bank case history examined by 
this Subcommittee eight years ago, 1704 provides evidence that the current OCC examination 
system has tolerated severe AML deficiencies for years and given banks great leeway to address 
targeted AML problems without ensuring the effectiveness of their AML program as a whole. 
As a result, the current OCC examination process has allowed AML issues to accumulate into a 
massive problem before an OCC enforcement action is taken. 

At HSBC, during the five-year period from 2005 to 2010, OCC AML examiners 
conducted nearly four dozen AML examinations, identified at least 83 AML Matters Requiring 
Attention, and recommended two cease and desist orders to strengthen HBUS' AML program. 
Despite the many AML problems identified by its examiners, OCC supervisors took no formal or 
informal enforcement action during nearly that entire period, allowing the bank' s AML problems 
to fester. In 2009, after learning that two law enforcement agencies were investigating possible 
money laundering through HBUS accounts, the OCC legal and enforcement divisions directed 
OCC AML examiners to hastily intensify and expand an ongoing AML examination to consider 
HBUS' AML program as a whole. In September 2010, the expanded OCC examination 
culminated in a blistering Supervisory Letter identifying numerous, serious AML problems at the 
bank. Many of these AML problems had been identified in prior examinations, but were tied to 
specific HBUS business units rather than applied bankwide, and were not resolved by bank 
commitments to remedy the identified problems. 

The September 13, 2010 Supervisory Letter criticizing HBUS' AML deficiencies ran 31 
pages long. 1705 It cited the bank for five violations of federal AML law. Its list of AML 
problems included a backlog of over 17,000 unreviewed alerts regarding possible suspicious 
activity, and a failure to timely file hundreds of Suspicious Activity Reports (SARs) based upon 
those alerts. The Supervisory Letter also criticized HBUS for failing to conduct any due 
diligence or to assess the AML risks posed by HSBC affiliates that opened U.S. dollar 
correspondent accounts at HBUS, even though many of those affiliates operated in high risk 
jurisdictions, had high risk clients, or offered high risk products. Another problem was a three- 
year failure by HBUS, from mid-2006 to mid-2009, to conduct any AML monitoring of billions 
of dollars in bulk cash transactions, including $15 billion from 2007 to 2008 alone, with those 
same HSBC affiliates, despite the risks associated with large cash transactions. 



See "FAQs - HSBC Money Laundering Enforcement Action," attached to 10/6/2010 email from OCC James 
Vivenzio to OCC colleagues, "HSBC FAQs," OCC-PSI-00898845, at 5. 

1703 Id. 

1704 See "Money Laundering and Foreign Corruption: Enforcement and Effectiveness of the Patriot Act," U.S. 
Senate Permanent Subcommittee on Investigations, S.Hrg. 108-633 (July 15, 2004). 

1705 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering ('BSA/AML') 
Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335, at 342. [Sealed 
Exhibit.] 
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In addition, the Supervisory Letter criticized HBUS' failure to conduct any AML 
monitoring of $60 trillion annually in wire transfer activity by customers domiciled in countries 
rated by HBUS as lower risk, unless a customer was individually rated as high risk, while also 
criticizing the bank's country risk assessment process. The OCC attributed the bank's 
monitoring failure in part to HBUS' goal of minimizing AML staffing requirements. To place 
the magnitude of the AML vulnerability created by HBUS in context, the OCC noted that, from 
2005 to 2009, HBUS' wire activity had grown from 20.4 million to 30.2 million wire 
transactions per year, with annual dollar volumes climbing from $62.4 trillion to $94.5 trillion, 
an increase of 50%. The OCC also noted that HBUS had become the third largest user of the 
CHIPS wire transfer system which provides 95% of U.S. dollar cross-border and nearly half of 
all domestic wire transactions totaling $1.5 trillion daily. 1706 

The letter didn't stop there. It also offered a slew of criticisms of the techniques used by 
HBUS to identify suspicious activity, describing them as "ineffective," "inadequate," and overly 
reliant on a "highly discretionary manual monitoring approach," all of which decreased the 
number of AML alerts. Additional problems included inappropriate procedures to close alerts; 
an "inadequate focus on country risk instead of customer risk"; the failure to assign high risk 
ratings to high risk clients, including Politically Exposed Persons; inadequate and unqualified 
AML staffing; inadequate AML resources; and high turnover in AML leadership. Despite its 
own failures to take proactive steps to oversee the bank, the OCC letter noted that the bank had 
not been proactive enough in identifying and remediating its own AML problems: 

"Through year-end 2009, the OCC has issued 83 BSA/AML Matters Requiring Attention 
("MRAs"). The bank has a history of not identifying BSA/AML problems proactively. 
Instead, the bank has taken a reactive posture, choosing to focus its attention on 
correcting specific deficiencies identified by regulators without taking comprehensive 

1 707 

action to identify and correct deficiencies in the bank's overall BSA/AML program." 

A month later, on October 4, 2010, the OCC issued a Cease and Desist Order requiring HBUS to 
revamp its AML program. 1708 In response, HBUS committed to making major changes. 

At the time the OCC issued the October Cease and Desist Order, it had been conducting 
regular AML oversight of HBUS for six years, raising the issue of how such deep-seated AML 
deficiencies could have gone on at the bank without the regulator's taking action. Part of the 
answer is that HBUS, like other international banks, presented the OCC with a number of AML 
challenges. It functioned as the U.S. nexus for one of the largest banks in the world. The HSBC 
network was not based in the United States, and its central focus was not on U.S. customers or 
U.S. businesses, but on other areas of the globe. HSBC affiliates operated in a number of 
jurisdictions which faced huge AML risks from terrorist financing, drug trafficking, tax evasion, 
and other law enforcement problems. The HSBC Group was also one of the largest participants 



1/Ub ld. at 342-343. 

1707 Id. 

1708 See In re HSBC Bank USA, N.A. , Case No. AA-EC-10-98, Department of the Treasury Comptroller of the 
Currency, Consent Order (10/4/2012), OCC-PSI-00904698. On the same day, the Federal Reserve issued a Cease 
and Desist Order against HBUS' holding company, HSBC North America Holdings, Inc. (HNAH) to require it to 
strengthen its AML program. See In Re HSBC North America Holdings, Inc. , Case No. 10-202-B-HC , before the 
Board of Governors of the Federal Reserve System, Cease and Desist Order Issued Upon Consent Pursuant to the 
Federal Deposit Insurance Act as Amended (10/4/2012). 
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in international wire transfer systems and a leader among global banks in moving large amounts 
of physical currency around the world, with all the attendant AML risks inherent in large cash 
transactions. HSBC also handled numerous high risk clients and high risk products. In addition, 
as OCC examinations disclosed over the years, it was a financial institution with inadequate 
AML resources; inadequate AML systems and controls; and inadequate AML leadership. 

HBUS itself was a large, complex, and growing financial institution with numerous 
business lines, products, and services, as well as millions of customers. It also had 
correspondent accounts for more than 80 HSBC affiliates as well as financial institutions around 
the world. From the time the OCC became HBUS' primary regulator in 2004, it oversaw HBUS' 
AML program and conducted regular examinations throughout the bank. Year after year, those 
AML examinations exposed AML deficiencies. Each time problems were identified, HBUS 
promised to correct them and sometimes did. But those corrective actions were narrowly 
targeted and, instead of improving, the bank' s overall AML program deteriorated, resulting in 
the dramatic failures described in the September 2010 Supervisory Letter. 

The focus of this section is to chronicle the OCC's AML oversight efforts at HBUS and 
draw from that case history potential lessons regarding OCC examinations of AML controls at a 
large global bank; how AML problems can accumulate over years despite the OCC's presence, 
and what can be done to strengthen the OCC's AML oversight. Problems include the OCC's 
decision to treat AML deficiencies as a consumer compliance problem rather than a management 
problem with safety and soundness implications; its practice of foregoing the citation of legal 
violations for the failure to comply with mandated components of a AML program; its use of 
narrowly focused AML examinations without also examining a bank's overall AML program; its 
failure to make timely use of informal and formal enforcement actions to compel AML 
improvements; and its use of Supervisory Letters that sometimes muted examination criticisms 
or weakened recommendations for reforms. Actions to remedy these problems would strengthen 
the OCC's AML oversight and help protect the U.S. banking system from being misused for 
terrorist financing, money laundering or other misconduct. 

A. Background 

(1) Key Anti-Money Laundering Laws 

Federal law defines money laundering as "the movement of illicit cash or cash equivalent 
proceeds into, out of, or through the United States [or] . . .United States financial institutions." 1709 
Federal anti-money laundering laws also apply to terrorist financing, including any legally 
obtained funds if intended for use in planning, committing, or concealing a terrorist act. 1710 
These laws arose as a result of law enforcement investigations demonstrating that terrorists, drug 
traffickers, tax evaders, and other criminals were using financial transactions to execute their 
crimes, including by transferring funds across international lines, recharacterizing illicit proceeds 
as legitimate funds, hiding assets, and using financial and corporate secrecy laws and practices to 



1709 31 U.S.C. § 5340(2). 

1710 See, e.g., 18 U.S.C. § 981(a)(1)(G) (civil forfeiture laws applicable to laundered proceeds also apply to terrorist 
assets). 
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block inquiries into their activities. U.S. AML laws are designed to prevent these wrongdoers 
from misusing the U.S. financial system to commit their crimes. 

Three key laws lay out the basic AML obligations of U.S. financial institutions, the 
Money Laundering Control Act of 1986, the Bank Secrecy Act of 1970, and the USA Patriot Act 
of 2002, which amended both prior laws. 1711 

The Money Laundering Control Act, enacted partly in response to hearings held by this 
Subcommittee in 1985, was the first law in the world to make money laundering a crime. It 
prohibits any person from knowingly engaging in a financial transaction which involves the 
proceeds of a "specified unlawful activity." 171 The law provides a long list of specified 
unlawful activities, including, for example, terrorism, drug trafficking, fraud, and foreign 
corruption. The Bank Secrecy Act (BSA), as amended by the Patriot Act, imposes AML 
obligations on a designated list of financial institutions operating in the United States to ensure 
they do not facilitate money laundering or become conduits for terrorist financing. 

AML Requirements. The Bank Secrecy Act mandates that covered financial institutions 
establish an effective AML program that meets four minimum requirements: 

1) It has a system of internal controls to ensure ongoing compliance. 

2) It designates an individual responsible for managing AML compliance. 

3) It provides AML training for appropriate personnel. 

1713 

4) It requires independent testing of AML compliance. 

These four components are sometimes referred to as the "pillars" of an effective AML 
program. The first requirement for a system of AML "internal controls" involves development 
of risk-based policies and procedures to detect and prevent money laundering. 1714 At a large 
bank, these safeguards would include Know-Your Customer (KYC) policies and procedures, 
including developing a customer identification program, conducting due diligence reviews, and 
assessing customer risk; a monitoring system to analyze account and wire transfer activity to 
detect suspicious activity; and a system for reporting suspicious activity to law enforcement. To 
ensure AML controls are implemented effectively, banks are also required to provide appropriate 
resources, infrastructure, and staff. 



1711 For a more detailed discussion of U.S. AML laws, see "Anti-Money Laundering: Issues Concerning Depository 
Institution Regulator Oversight," testimony of the General Accounting Office, Report No. GAO-04-833T, 
(6/3/2004), before the U.S. Senate Committee on Banking, Housing, and Urban Affairs, at 4-6. 
http ://www. gao . go v/ne w. items/d048 3 3t.pdf 
1712 18 U.S.C. §§ 1956-57. 

1713 See 31 U.S.C. § 5318(h)(1) and 12 C.F.R. Section 21.21(b)(1). All federal bank regulators have adopted the 
same requirements within their own regulations. The OCC will cite apparent violations of Section 21.21(b)(1). 
However, it will not cite violations for the four subcomponents (Sections 21.21 (c)(l)-(4)), whereas the other federal 
banking agencies will. The OCC's practice is inconsistent with the other federal regulators. As will be 
demonstrated later in this report, this practice potentially spares the bank from more strenuous criticism from its 
regulator. 

1714 31 U.S.C. § 5318(h)(1)(A) and 12 C.F.R. Section 21.21(c)(1). 
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The second requirement is to designate a qualified individual for coordinating and 

1715 

monitoring the bank's day-to-day AML compliance. The AML compliance officer must be 
knowledgeable about the law and have the time, expertise, authority, and resources needed to 
ensure bank compliance with AML requirements. The AML compliance officer should also 
have the authority to make regular reports to the bank' s board of directors or a board designated 
committee. 

The third requirement is for the bank to provide adequate training to all personnel with 
AML responsibilities. 1716 AML training should be ongoing to ensure bank personnel are kept 
up-to-date with the law. The fourth requirement is for the bank to conduct independent testing of 
its AML program and controls to ensure compliance with the law and to identify and correct any 
AML deficiencies. 1717 This function is typically performed by a bank's internal audit group or 
by an outside auditor with AML expertise. 

Other AML Requirements. In addition to requiring covered financial institutions to 
establish effective AML programs, federal AML laws include a number of other statutory 
requirements, including requiring banks that keep records outside of the United States to produce 

1718 

them within a specified period of time; to obtain identifying information for persons seeking 
to open or maintain accounts, 1719 and requiring appropriate due diligence when opening and 
administering accounts for foreign financial institutions or senior foreign political figures. 1720 
The Bank Secrecy Act also authorizes and the U.S. Department of Treasury has issued 
regulations requiring covered financial institutions and other businesses to file reports on large 
currency transactions and suspicious activities to guard against money laundering. 1721 

(2) AML Oversight In General 

The Secretary of the Treasury is the primary federal regulator charged with enforcing key 
federal AML laws. 1722 To help carry out those responsibilities, in 2003, the Secretary 
established the Executive Office for Terrorist Financing and Financial Crimes, headed by a 
Deputy Assistant Secretary. This office oversees the operation of the Financial Crimes 
Enforcement Network (FinCEN), a Treasury bureau which, among other duties, develops AML 
regulations and guidance, analyzes currency transaction reports and suspicious activity reports 
filed by financial institutions, and interacts with local, state, federal, and international law 
enforcement as well as other financial intelligence units around the world. Treasury also 
oversees the Office of Foreign Assets Control (OFAC) which is primarily responsible for 
enforcing U.S. sanctions laws to detect and block financial transactions and assets belonging to 
identified terrorists, persons associated with weapons of mass destruction, drug traffickers, and 
rogue jurisdictions. 



1/13 31 U.S.C. § 5318(h)(1)(B) and 12 C.F.R. Section 21.21(c)(3). 

1716 31 U.S.C. § 5318(h)(1)(C) and 12 C.F.R. Section 21.21(c)(4). 

1717 31 U.S.C. § 5318(h)(1)(C) and 12 C.F.R. Section 21.21(c)(2). 

1718 31 U.S.C. §5318(k)(2). 

1719 31 U.S.C. § 5318(1). 

1720 31 U.S.C. § 5318(i). 

1721 See, e.g., 31 U.S.C. §§5313 and 5318(g); 31 C.F.R. §§ 103.11 and 103.21 et seq. 

1722 See, e.g. 31 U.S.C. §§5311 et seq. (Treasury Secretary charged with carrying out key anti-money laundering 
laws) and § 5341 (Treasury Secretary given lead role in development of national anti-money laundering strategy). 
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Although FinCEN is the administrator of federal AML regulations in the United States, it 
does not examine banks. That task is assigned to federal bank regulators which are charged with 
monitoring bank compliance with AML laws through their examination procedures. Any AML 
violations they discover are reported to FinCEN which can, among other actions, impose civil 

1 79^ 

monetary penalties on financial institutions for the violations. 

Significant responsibility for AML oversight, thus, rests with federal bank regulators. 
The decisions they make with respect to AML policies and procedures, AML examinations, and 
safety and soundness ratings consequences for AML deficiencies will in large measure determine 
the importance that both regulators and financial institutions place on achieving effective AML 
controls. 

Oversight of Financial Institutions. At the end of 2010, the United States had over 
7,600 federally insured commercial banks and savings institutions. 1724 In addition, the United 

1 79 S 

States had over 7,300 federally insured credit unions. On the federal level, these financial 
institutions are overseen by four agencies: the Federal Reserve which supervises state-chartered 
banks that are part of the Federal Reserve System and certain financial holding companies; the 
Federal Deposit Insurance Corporation (FDIC) which supervises state-chartered banks that were 
not part of the Federal Reserve System; the Office of the Comptroller of the Currency (OCC) 
which supervises banks and savings associations with national charters, and certain U.S. 

1727 

affiliates of foreign-owned banks; and the National Credit Union Administration (NCUA) 
which supervises federal and state-chartered credit unions. In addition, state banking authorities 
supervise and examine state-chartered institutions. 

The primary responsibility of the federal bank regulators is to ensure the "safety and 
soundness" of the financial institutions they supervise. One key mechanism they use to carry out 
that responsibility is to conduct safety and soundness examinations on a periodic basis and 
provide the results in an annual Report of Examination (ROE) to the Board of Directors of each 
financial institution. Safety and soundness examinations are conducted to assess the risk that an 
insured bank poses to the federal Deposit Insurance Fund. All FDIC-insured institutions 
contribute to this insurance fund through assessments which are typically collected on a quarterly 
basis. The assessment amounts are based, in part, on a bank's safety and soundness ratings. 



See FinCEN Enforcement Actions, http://www.fincen.gov/news_room/ea/ ("Under the Bank Secrecy Act 
(BSA), 31 U.S.C. 5311 et seq., and its implementing regulations at 31 C.F.R. Chapter X (formerly 31 C.F.R. Part 
103), FinCEN may bring an enforcement action for violations of the reporting, recordkeeping, or other requirements 
of the BSA. FinCEN 's Office of Enforcement evaluates enforcement matters that may result in a variety of 
remedies, including the assessment of civil money penalties."). 

1724 See the Federal Deposit Insurance Corporation's (FDIC) Statistics at a Glance, (Fourth Quarter 2010). This 
includes 6,529 commercial banks and 1,128 savings institutions. 

http ://www. fdic . go v/bank/statistical/stats/20 1 Odec/industry . html 

1725 See the National Credit Union Administration's (NCUA) 2010 Annual Report, "Insurance Fund Ten-Year 
Trends" chart, page 133. This figure includes 4,589 federal and 2,750 state-chartered credit unions. 
http://www.ncua.gov/Legal/Documents/Reports/AR2010.pdf 

1726 The FDIC also acts as a backup regulator for all financial institutions with federal deposit insurance. 

1727 Until recently, the Office of Thrift Supervision (OTS) supervised federal savings associations and institutions, 
but it was abolished by the Dodd Frank Wall Street Reform and Consumer Protection Act. All OTS duties were 
officially transferred to the OCC on July 21, 201 1. 
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The largest U.S. financial institutions are supervised under a "continuous examination" 
program. Under this program, examiners are always on-site at the institution, as opposed to 
periodically arriving on-site, conducting an examination, and then departing for the next bank 
after finalizing the ROE. Examinations at smaller community banks are typically conducted on a 
12- or 18-month exam cycle. Examiners are typically on-site at smaller community banks for 
only a few weeks. 

Interagency AML Examination Manual. In June 2005, the Federal Financial 

1728 

Institutions Examination Council (FFIEC) issued a joint AML Examination Manual. This 
manual was developed by the federal bank regulators, in collaboration with FinCEN, OFAC, and 
state banking agencies. It was developed to provide current and consistent AML examination 
procedures and guidance to examiners across the federal banking agencies and the financial 
institutions they oversee. The manual has been updated three times to incorporate regulatory 
changes and reflect feedback from the banking industry and examination staff. The most recent 
version of the manual was released in April 2010. 

Safety and Soundness Examinations. Federal bank regulators conduct several different 
examinations at the financial institutions they supervise. The most important is the safety and 
soundness examination. Federal bank regulators conduct safety and soundness examinations to 
assess the risks that a bank poses to the federal Deposit Insurance Fund (DIF) and to maintain 
public confidence in the integrity of the banking system. These examinations help prevent 
identified problems from deteriorating to the point of bank failures, the costs of which are often 
borne by the DIF. The DIF is funded by assessments that the FDIC charges banks. These 
assessments are derived from the level of insured deposits that a bank holds and the inherent 
risks that the bank poses to the DIF, which are calculated in part from a bank's safety and 
soundness component ratings and composite rating. 

Safety and soundness examinations are designed to determine the financial condition of 
an institution, assess the effectiveness of its risk management practices, and aid in the 
development of effective and timely corrective actions. The examinations evaluate the bank's 
adherence to a variety of laws and regulations, identify and assess key risks, and identify and 
assess any problems. 

CAMELS Ratings. Safety and soundness examinations are organized around a rating 
system called CAMELS, an acronym for the six components that are evaluated. The CAMELS 
rating system evaluates a financial institution's: (C) capital adequacy, (A) asset quality, (M) 
management effectiveness, (E) earnings, (L) liquidity, and (S) sensitivity to market risk. Each 
component of the CAMELS rating is based upon a qualitative analysis of various factors 



The FFIEC is a formal interagency body empowered to prescribe uniform principles, standards, and report forms 
for the federal examination of financial institutions by the Federal Reserve, FDIC, OCC, NCUA, and the Consumer 
Financial Protection Bureau (CFPB), and to make recommendations to promote uniformity in the supervision of 
financial institutions. See FFIEC website, http://www.ffiec.gov/. In 2006, the State Liaison Committee (SLC) was 
added to the Council as a voting member. The SLC includes representatives from the Conference of State Bank 
Supervisors, the American Council of State Savings Supervisors, and the National Association of State Credit Union 
Supervisors. The CFPB became an FFIEC member in 2011. The Office of Thrift Supervision was also an FFIEC 
member, until the agency was abolished in 201 1. 

1729 See 4/29/2010 "BSA/AML Examination Manual," Federal Financial Institutions Examination Council, 
http://www.ffiec.gov/bsa_aml_infobase/documents/BSA_AML_Man_2010.pdf. 
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comprising it. CAMELS ratings use a scale of 1 to 5, with "1" being the best rating and "5" the 
worst. 

The CAMELS component ratings also serves as the basis for a bank's "Composite 
Uniform Financial Institution Rating," often referred to as the "composite rating" or the overall 
"bank rating." The composite rating also uses a scale of 1 to 5, and generally bears a close 
relationship to the component CAMELS ratings, although it is not simply an average of them. 
For composite ratings, 1 is the highest rating and signifies a safe and sound institution with no 
cause for supervisory concern, 3 signifies an institution with supervisory concerns in one or more 
areas, and 5 is the lowest rating, which signifies an unsafe and unsound bank with severe 
supervisory concerns. 

When the FDIC assesses bank insurance fees for a particular institution, it takes into 
consideration both the CAMELS component ratings and the composite rating. Lower ratings, 
signifying a higher risk institution and a greater threat to the Deposit Insurance Fund, can lead to 

1 7^0 

a higher deposit insurance assessment, which in turn can affect net income. 

Specialty Examinations and Ratings. In addition to safety and soundness 
examinations, federal bank regulators also conduct various specialty or secondary examinations 
targeting particular aspects of the institutions they supervise. These specialty examinations, 
which are separate and distinct from safety and soundness examinations, are important in their 
own right, and focus on such areas as information technology (IT), trust operations, compliance 
with the Community Reinvestment Act (CRA), and compliance with consumer protection 
laws. 1731 

Each of these specialty examinations has its own unique rating system based upon an 
interagency agreement on what elements should be considered and how the rating should be 
calculated. For example, IT examinations produce ratings under a "Uniform Rating System for 
Information Technology"; trust examinations produce ratings under a "Composite Uniform 
Interagency Trust Rating" system; CRA examinations produce ratings under a "Community 
Reinvestment Act Rating" system; and consumer compliance examinations produce ratings 
under a "Uniform Interagency Consumer Compliance Rating" system. 



See page 3 - sample deposit insurance assessment invoice, 
http://www.fdic.gov/deposit/insurance/assessments/EV2Sample.pdf. 

1731 According to the OCC, typical issues addressed by these specialty examinations are as follows: 

• Information Technology (IT) Examinations - evaluate IT-related risks including operations, information 
security programs, and IT governance processes within supervised financial institutions and technology 
service providers. 

• Trust/Asset Management Examinations - determine if an institution's policies or administration of trust 
accounts has resulted in a contingent liability or estimated loss that could damage the institution's capital. 

• Consumer Compliance Examinations - assess a financial institution's compliance with federal consumer 
protection laws and regulations. 

• Community Reinvestment Act (CRA) Examinations - ensure compliance with the CRA, to include meeting 
the credit needs of the community that the financial institution serves, including residents of low- and 
moderate -income neighborhoods. 

See OCC website, "Examinations: Overview," http://www.occ.gov/topics/examinations/examinations- 
overview/index-examinations-overview.html 

1732 7/26/2006 OCC Report of Examination of HBUS for the examination cycle ending March 31, 2006, OCC-PSI- 
00422079, at 4. [Sealed Exhibit.] 
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These ratings are typically presented in the annual Report of Examination provided to a 
financial institution by its primary regulator. They are typically included in a section which lists 
all of the ratings assigned to the bank during the year. The specialty examination ratings are 
calculated and presented separately from the CAMELS component ratings which give rise to the 
bank's overall Composite Uniform Financial Institution Rating. In OCC Reports of 
Examination, for example, the ratings are usually presented in the following format: 

Ratings 

Composite Uniform Financial Institution Rating 

Component Ratings: 
Capital 
Asset Quality 
Management 
Earnings 

Liquidity - Asset/Liability Management 
Sensitivity to Market Risk 

Uniform Rating System for Information Technology 
Composite Uniform Interagency Trust Rating 
Uniform Interagency Consumer Compliance Rating 
Community Reinvestment Act Rating. 1733 

While specialty examination ratings do not automatically or routinely affect either the 
CAMELS component or composite ratings, if a specialty examination identifies significant 
problems that are extensive enough to potentially affect the financial condition of the bank, 
including through the imposition of large civil money penalties, reimbursable violations, or 
reputational risk, it may contribute to a downgrade of one or more of the CAMELS component 
ratings which, in turn, may affect the composite rating. 1734 Downgrades to safety and soundness 
ratings due to problems identified through specialty examinations are not common, however, and 
are reserved for extreme cases. 

AML Examinations. An examination focusing on AML compliance is considered a 
specialty examination. Each of the federal banking agencies has examiners specially trained to 
conduct AML examinations. AML examinations do not, however, produce a separate specialty 
rating, since no interagency agreement has produced an AML rating system. Instead, at federal 
banking agencies other than the OCC, AML examination findings are generally addressed as one 
of the safety and soundness considerations in the Report of Examination (ROE) and included in 
the development of the bank's safety and soundness ratings. Typically, AML examination 



1733 Id. 

1734 See, e.g., Federal Financial Institutions Examination Council, "Uniform Financial Institutions Ratings System," 
61 FR 245, at 67021 (12/19/1996), http://www.gpo.gov/fdsys/pkg/FR-1996-12-19/pdf/96-32174.pdf 
("Generally, the impact of specialty area examination findings are reflected in the composite and Management 
component ratings."). 
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results impact the CAMELS management component rating, which may be downgraded if 
management fails to maintain an adequate AML program. 

The CAMELS management component rating is designed to reflect the ability of bank 
management to adequately identify, measure, monitor, and control problems and manage 
risks. 735 Although AML compliance is just one factor in rating the management component, a 
bank's failure to maintain an adequate AML program can expose a bank to significant 
reputational risk, remedial costs, and civil money penalties. When such factors are present, 
federal bank regulators normally take them into account when assigning the management 
component rating. If the management component is downgraded, it may also in certain 
circumstances lower the bank's overall composite rating, with potentially severe impacts on the 
financial institution's reputation, risk profile, and insurance assessment fees. 

In contrast to this approach, which is used by the Federal Reserve, FDIC, and NCUA, the 
OCC does not treat AML examinations as a safety and soundness matter and does not routinely 
take AML deficiencies into account when assigning a bank's CAMELS management rating. 
Instead, the OCC treats AML examinations as a matter of consumer compliance and includes 
consideration of AML deficiencies when determining an institution's consumer compliance 
rating. The OCC's approach is explained more fully below. 

Violations of Law. In their supervisory programs, federal bank regulators assign a high 
priority to the detection and prompt correction of violations of law. Such violations may involve 
statutory or regulatory requirements. Regulators typically list all significant violations of law (as 
opposed to isolated or technical violations) in the annual Report of Examination provided to a 
bank's board of directors. The board of directors, in turn, is charged with initiating prompt and 
appropriate corrective action. 

Listing one or more statutory or regulatory violations in a Report of Examination is not 
uncommon. They may result from bank management's unfamiliarity with the governing law, 
misinterpretation of the requirements, negligence, or willful noncompliance. The more 
egregious the nature of the violation, the more severe the repercussions may be. Willful 
noncompliance with statutory or regulatory requirements, for example, may result in civil money 
penalties against the bank or individual bank managers as well as removal actions against bank 
personnel, officers, or directors. Violations are also viewed as significant adverse reflections on 
bank management capabilities and may lead to a downgrade of the CAMELS management 
component rating. The underlying causes of the violation play a significant role in that 
assessment. 

Enforcement Actions. If a bank regulator becomes concerned about the condition of a 
financial institution, it has a wide range of informal and formal enforcement actions that could be 
used to require corrective action. Informal actions are viewed as voluntary actions and include 
requesting that the financial institution issue a safety and soundness plan, board resolution, or 
commitment letter pledging to take specific correction actions by a certain date. Another 
informal action is a memorandum of understanding, which is a signed agreement by both the 
regulator and the board of directors addressing various actions that the financial institution will 



See, e.g., Federal Financial Institutions Examination Council, "Uniform Financial Institutions Ratings System," 
61 FR 245, at 67021 (12/19/1996), http://www.gpo.gov/fdsys/pkg/FR-1996-12-19/pdf/96-32174.pdf. 
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take to correct its problem areas. Informal actions are nonpublic and are not enforceable in 
court. On the other hand, formal enforcement actions are legal proceedings which can include 
issuing a consent order or a cease and desist order requiring the financial institution to stop an 
unsafe or unsound practice or to take affirmative action to correct identified problems; imposing 
a civil money penalty; suspending or removing personnel from the financial institution; 
suspending or banning personnel from the banking industry; revoking the bank charter; or 
referring misconduct for criminal prosecution. Formal actions are disclosed to the public and are 
enforceable in court. Failure to comply with an order can subject the bank to civil money 
penalties. 

With respect to AML enforcement, in July 2007, the federal bank regulators issued joint 
interagency guidance entitled, "Interagency Statement on Enforcement of Bank Secrecy 
Act/ Anti-Money Laundering Requirements." 1736 This guidance sought to promote consistent 
implementation of Section 8(s) of the Federal Deposit Insurance Act and Section 206(q) of the 
Federal Credit Union Act, both of which require federal bank regulators to conduct AML 
examinations and identify AML problems in Reports of Examination. Both sections also require 
federal bank regulators to issue a cease and desist order in the event that a bank fails to provide 
or maintain an adequate AML program. The guidance affirms the federal bank regulators 
authority and responsibility for enforcing AML requirements and use of cease and desist order to 
correct identified problems. 

(3) OCC AML Oversight in General 

Because it oversees the largest and most complex banks operating in the United States, 
some of which operate affiliates in high risk jurisdictions, maintain accounts for high risk clients, 
or offer high risk products vulnerable to money laundering and terrorist financing, the OCC 
plays a crucial role in ensuring bank compliance with U.S. AML laws. 

OCC Organization. The OCC oversees about 2,000 nationally-chartered banks and 

1737 

savings associations and about 50 U.S. affiliates of foreign-owned banks. In 201 1, the 
OCC's budget, which is paid for by assessments on the financial institutions it regulates, totaled 
about $875 million. 1 " 8 As of 201 1, about 3,700 OCC employees were stationed in 66 offices 
nationwide, organized into four districts known as the Northeastern, Central, Southern, and 

1 7^Q 

Western districts, with agency headquarters in Washington, D.C. 

Several groups within the OCC contribute to AML oversight. Examiners with special 
expertise conduct the actual AML examinations, evaluate bank AML programs, and identify 
AML deficiencies. They provide their findings to the Examiner- In-Charge at a particular 



See 7/19/2007 "Interagency Statement on Enforcement of Bank Secrecy Act/Anti-Money Laundering 
Requirements," reprinted in 8/24/2007 FFIEC BSA/AML Examination Manual, at R-l to R-7, 
http://www.ffiec.gov/bsa_aml_infobase/documents/BSA_AML_Man_2007.pdf. 

1737 See 201 1 OCC Annual Report, at 1, chart entitled "National Banking System at-a-Glance," 
http://www.occ.gov/publications/publications-by-type/annual-reports/201 lAnnualReport.pdf; OCC website, "About 
the OCC," http://www.occ.gov/about/who-we-are/comptroller-of-the-currency/bio-thomas-curry.html. 

1738 201 1 OCC Annual Report, at 1, chart entitled "OCC at-a-Glance," 

http://www.occ.gov/publications/publications-by-type/annual-reports/201 lAnnualReport.pdf. 

1739 201 1 OCC Annual Report, at 1, chart entitled "OCC at-a-Glance," 

http://www.occ.gov/publications/publications-by-type/annual-reports/201 lAnnualReport.pdf. Id.; OCC website, 
"About The OCC," http://www.occ.gov/about/who-we-are/district-and-field-offices/index-organization.html. 
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financial institution. At large banks, if AML deficiencies are identified, the Examiner- In-Charge 
works with the OCC Department of Large Bank Supervision to evaluate the AML examination 
findings and direct efforts to ensure bank compliance with the law. Bank supervision personnel 
also work with counsel in the Enforcement and Compliance Department and the Legal 
Department to determine whether AML enforcement actions are needed and, if so, what actions 
to take. 

During most of the years reviewed by the Subcommittee, the OCC was headed by John 
C. Dugan who served as the Comptroller of the Currency until his five-year term expired in 
2010. In August 2010, he was succeeded by John Walsh who served as Acting Comptroller until 
April 2012, when Thomas Curry was confirmed by the Senate to serve as the new Comptroller of 
the Currency. The second in command during most of the years reviewed was First Senior 
Deputy Comptroller and Chief Counsel Julie Williams. The head of the Department of Large 
Bank Supervision, which oversees the largest nationally-chartered U.S. banks and U.S. branches 
of foreign banks was Michael L. Brosnan. One of his chief deputies was Grace Dailey who 
helped oversee HBUS, until the end of 2010, when she left that post for another, and was 
replaced by Sally Belshaw. Two other key OCC officials in AML enforcement were Daniel 
Stipano, Deputy Chief Counsel, and James Vivenzio, senior legal counsel for AML matters. In 
addition, the Director of the Enforcement and Compliance Department was Richard Stearns. 

OCC Examinations Generally. Much of the OCC workforce is devoted to conducting 
or supporting safety and soundness examinations of the banks regulated by the OCC. In general, 
for a large bank, the relevant OCC district office assigns an Examiner-in-Charge (EIC) and a 
team of examiners to work on-site at the bank, on a fulltime basis under a continuous 
examination program. 

Under the OCC's continuous examination program, the EIC is assigned to a particular 
institution for five years. At the five-year mark, the EIC is then assigned to another bank. The 
EIC is assisted by a team of examiners that are also assigned to the bank on a full-time basis, but 
do not have similar five-year term limitations. Members of the examination team may rotate to 
other banks at various intervals as needed. Regardless, examiners work at the bank year-round 
and should have a firm and immediate grasp on any issues and problems affecting the bank. 

Supervisory Strategy. The EIC is responsible for developing an annual supervisory 
strategy. The supervisory strategy is a prospective work plan for examining the bank, based on 
perceived risks. The strategy addresses supervisory areas of interest, including what targeted 
examinations will be conducted throughout the coming year. Targeted examinations address 
what are called "specialty areas," such as Information Technology, Consumer Compliance, 
Community Reinvestment Act, and Trust areas. The EIC develops the supervisory strategy, 
including strategies with respect to the specialty areas with input from examiners, called "team 
leads," who have lead responsibility for conducting the examinations in those areas. At the 
OCC, AML compliance is not considered a separate specialty area, but is included within 
Consumer Compliance specialty examinations. The EIC ultimately presents the annual 
supervisory plan for approval to the deputy comptroller for Large Bank Supervision at OCC 
headquarters in Washington. 
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Targeted Examinations. Based on the supervisory strategy, a series of specialized or 
"targeted examinations" is conducted throughout the year. OCC "Request Letters" are sent to a 
bank approximately 30 days before the start of each targeted examination. Request Letters give 
the bank advance notice of the examination and include a list of requested items that the bank 
should assemble for the examiners to review at the start of the examination. 

The examiners then conduct an examination of a specific area of the bank and write a 
"Conclusion Memorandum" summarizing their findings for the EIC. The examiners may also 
contribute to any related Supervisory Letter that the EIC sends to bank management and any 
relevant portion of the annual Report of Examination provided to the bank's board of directors. 

Supervisory Letters are used by the OCC officially to inform a bank of the findings of a 
specialty examination and issues that warrant management's attention. For large banks under 
continuous examination, the OCC typically uses Supervisory Letters to provide detailed 
information to bank management about each specialty examination completed throughout the 
year. In addition to describing the examination findings, the Supervisory Letter can cite an 
apparent violation of law or a "Matter Requiring Attention" (MRA), meaning it requires the 
attention of the bank's senior management. Both violations and MRAs require prompt corrective 
action by the bank. 1740 A Supervisory Letter may also include one or more "recommendations" 
to enhance bank performance or compliance in a particular area. Under OCC regulation and 
practice, "recommendations" do not require corrective action by bank management. 1741 OCC 
personnel told the Subcommittee that the Supervisory Letters written by EICs should accurately 
reflect the findings and criticisms in the conclusion memoranda written by the examiners. 1742 

Before issuing a Supervisory Letter, the EIC is required to forward a draft of the letter to 
the OCC's Senior Deputy Comptroller in Washington for review. If the Supervisory Letter cites 
an AML violation or MRA requiring corrective action, it is referred to the Large Bank Review 
Committee (LBRC), which is comprised of three senior staff with AML expertise. 1743 The 
LBRC members are the senior legal counsel with AML expertise from the Legal Department, the 
Director for Bank Secrecy Act and Money Laundering Compliance, and the Director for 
Enforcement and Compliance. The LBRC was established in response to problems associated 
with the Riggs Bank AML examinations nearly ten years ago and is intended to ensure that OCC 
AML experts review field examiners' work and promote consistency in AML enforcement 
across large national banks. Until recently, it was optional for the LBRC to have the examiner's 
Conclusion Memorandum upon which the draft Supervisory Letter is based, but the LBRC has 
recently begun to require both before it will undertake a review of the draft letter. 1744 

Report of Examination (ROE). On an annual basis, for each large bank, the OCC 
issues a Report of Examination (ROE), summarizing the condition of the bank. The ROE 
normally includes all of the bank's ratings arising from examinations of the bank's safety and 
soundness and specialty areas, as well as all cited violations of law and significant MRAs. 



Subcommittee interviews of Joseph Boss (1/30/2012) and James Vivenzio (3/15/2012). Mr. Vivenzio told the 
Subcommittee, "An exam cited with an MRA is a failure" on the part of the bank. 

1741 Id. 

1742 Subcommittee interview of Joseph Boss (1/30/2012) and Elsa de la Garza (1/9/2012). 

1743 Subcommittee interview of James Vivenzio (3/15/2012). 

1744 Id. 
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Depending on the circumstances, the issues noted in Supervisory Letters provided to bank 
management throughout the year may or may not be referenced in the ROE. The EIC sends the 
ROE with a cover letter to the bank' s board of directors so that it has a written record of the 
regulator's concerns. In addition, on an annual basis, the EIC attends a board meeting and 
presents the consolidated examination findings contained in the ROE to ensure the Board is fully 
informed about the bank's ratings, financial condition, and any deficiencies. 

AML Examinations. Like other federal bank regulators, the OCC treats AML 
examinations as a specialty or targeted examination, and employs examiners with specialized 
AML expertise to conduct them. Upon completing an AML examination, the examiner is 
required to submit a Conclusion Memorandum to the Examiner- In-Charge of the bank describing 
the examination findings, any apparent violations of law, and possible recommendations, MRAs, 
or enforcement actions. The Examiner- In-Charge then sends a Supervisory Letter to the bank 
summarizing the AML examination findings and presenting any violations, MRAs, or 
recommendations . 

At the end of the year, when the OCC readies the annual Report of Examination (ROE) 
for the bank and summarizes examination findings made during the year, the OCC does not treat 
AML deficiencies as a safety and soundness matter. It does not discuss AML problems in the 
ROE's analysis of safety and soundness issues, nor does the OCC routinely take AML 
deficiencies into account when assigning the bank a CAMELS component rating for 
management or its overall composite rating. 

Instead, unique in the federal government, the OCC subsumes AML issues within its 
consideration of consumer compliance issues. 1745 The ROE discusses AML compliance in a 
section entitled, "Consumer Compliance" and combines that discussion with consideration of the 
bank's compliance with consumer protection and civil rights laws. In addition, the OCC takes 
AML deficiencies into consideration when assigning a bank's consumer compliance rating, even 
though the Uniform Interagency Consumer Compliance Rating System does not include AML 
considerations when specifying how to calculate that rating. 

Consumer compliance examinations normally cover a bank' s compliance with consumer 
protection laws, such as laws requiring accurate disclosures of fees and interest rates, 
understandable mortgage and credit card disclosures, and avoidance of unfair or deceptive 
practices. They also examine a bank's compliance with civil rights laws, such as prohibitions 
against discrimination against persons on the basis of race, religion, national origin, or other 
prohibited categories. 1746 The examinations test, for example, the adequacy of a bank's 



See 9/2007 "Comptroller's Handbook — Bank Supervision Process," Appendix D, at 89, 
http://www.occ.gov/publications/publications-by-type/comptrollers-handbook/_pdf/banksupervisionprocess.pdf, 
("However, the OCC does incorporate into the consumer compliance rating examination findings pertaining to 
compliance with the Bank Secrecy Act (BSA), anti-money laundering (AML), and Office of Foreign Asset Control 
(OFAC).")- See also 2006-2010 OCC Reports of Examination for HBUS. [Sealed Exhibits.] 
174 The OCC has identified a long list of relevant laws, including the Truth in Lending Act, Fair Credit Billing Act, 
Consumer Leasing Act of 1976, Fair Credit Reporting Act, Equal Credit Opportunity Act, Fair Debt Collection 
Practices Act, and Electronic Fund Transfers Act. See "Comptroller's Handbook — Consumer Compliance 
Examination," Appendix A, "Uniform Interagency Consumer Compliance Rating System," 
http://www.occ.gov/publications/publications-by-type/comptrollers- 
handbook/_paginated/overview/default.htm?startat=over0001 3.htm. 
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operating systems to track compliance with consumer protection laws, the documentation it uses 
for consumer products, and the content of files related to such products as mortgages, consumer 
loans, and credit cards. Those considerations are key to ensuring bank compliance with 
consumer protection and civil rights laws, but do not include and have no relevance to 
compliance with AML requirements to guard against money laundering and terrorist financing. 

Like CAMELS ratings, consumer compliance ratings use a scale of 1 to 5, with "1" being 
the best rating and "5" the worst. 1747 The consumer compliance rating is calculated and 
presented separately in the OCC's ROE, and typically has no impact on a bank's component 
CAMELS ratings or its overall composite rating and, thus, no impact on an evaluation of the 
bank's safety or soundness. 1748 A bank's consumer compliance rating typically comes into play 
if a bank wants to open a new branch or expand into a new area of consumer lending; the OCC 
generally will not approve such an application, unless the bank has a consumer compliance 
rating of 1 or 2, showing that it is treating its customers fairly. 1749 Those considerations are not 
relevant, however, to AML compliance issues. Additionally, there is no logical reason why poor 
AML compliance should lower a bank's consumer compliance rating when the two have 
virtually nothing in common. 

An internal OCC review raised these same concerns. In 2005, following the 
Subcommittee's report on the OCC's inadequate AML oversight of Riggs Bank, the OCC's 
Quality Management Division issued an internal report evaluating the OCC's AML supervision 
program. 1750 That report found that the interagency consumer compliance rating system was not 
designed to and did not address AML issues. It noted that the rating was "geared to more 
traditional consumer protection regulations, such as Regulation Z and Regulation B, but is silent 
relative to BSA/AML compliance issues." The report also noted: "Since the consumer 
compliance rating system was developed as a FFIEC initiative, OCC cannot modify the ratings 
outside of FFIEC." The report recommended that the OCC work with the FFIEC to try to 
change the ratings system to incorporate AML issues, but seven years later, the ratings system 
still excludes consideration of AML issues, perhaps because no agency other than the OCC 
attempts to combine consumer compliance and AML concerns into a single rating. 

AML Violations. In addition to subsuming AML concerns within its consumer 
compliance rating system, the OCC also has a unique approach to citing AML violations in its 
Supervisory Letters and Reports on Examination (ROE). 



See "Comptroller's Handbook — Consumer Compliance Examination," Appendix A, "Uniform Interagency 
Consumer Compliance Rating System," http://www.occ.gov/publications/publications-by-type/comptrollers- 
handbook/_paginated/overview/default.htm?startat=over0001 3.htm. 

1748 OCC officials told the Subcommittee that, in some circumstances, the consumer compliance rating could be 
taken into account when evaluating a bank's CAMELS management rating, although that was not typical. 
Subcommittee interview of James Vivenzio (3/15/2012) and Joseph Boss (1/30/2012). 

1749 See, e.g., 12 CFR 5.13(a)(2); branch application for national banks, at 7, 

http://www.occ.gov/static/licensing/form-branch-relo-app-v2.pdf; Branches and Relocations, Comptrollers 
Licensing Manual, at 4, http://www.occ.gov/publications/publications-by-type/licensing-manuals/branches.pdf. 
17 5/18/2005 "Bank Secrecy Act/Anti -Money Laundering Supervision," prepared by OCC Quality Management 
Division, HSBC OCC 2495056. 
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Like other federal bank regulators, the OCC often includes a list of apparent violations of 
law in its annual Reports of Examination. Those violations span a wide range of banking laws 
and regulations, including, for example, consumer compliance concerns. In the AML area, 
however, the Subcommittee has learned that the OCC has adopted a practice of limiting the types 
of AML violations it will cite either in a ROE or Supervisory Letter. 

Currently, all federal bank regulators, including the OCC, will cite an apparent violation 
of law in a Supervisory Letter or ROE if the regulator determines that a financial institution's 
entire AML program has failed. For the OCC, that citation would be an apparent violation of 31 
U.S.C. § 5318(h)(1) and the OCC implementing regulation, 12 C.F.R. Section 21.21(b)(1). On 
the other hand, if the OCC were to determine that a bank failed to comply with one of the four 
mandated components of an effective AML program — described earlier as internal controls, an 
AML compliance officer, AML training, and independent testing - the Subcommittee has been 
told that, contrary to all other federal bank regulators, the OCC generally will not cite a violation 
of one of the individualized program components, even though each component has its own 
statutory basis. For example, if a bank failed to provide adequate AML internal controls, federal 
bank regulators other than the OCC would cite the bank for violating 31 U.S.C. § 5318(h)(1)(A). 
In contrast, the OCC routinely forgoes the citation of violations of the individual AML program 
components, instead typically designating such a deficiency as a Matter Requiring Attention 
(MRA) by the bank. 17 

To examine the difference in the approach of the OCC versus other federal banking 
agencies, the Subcommittee reviewed five years of reports compiled by the U.S. Treasury's 
Financial Crimes Enforcement Network (FinCEN) which, among other matters, track the AML 
statutory violations cited by the agencies. 1754 Over the five year period from 2007 to 201 1, the 
FinCEN reports show that the OCC conducted about 6,600 examinations and cited pillar 
violations only 16 times. In comparison, the Federal Reserve conducted about 4,800 
examinations and cited pillar violations 159 times. The FDIC conducted about 12,800 
examinations and cited pillar violations 714 times. The OCC approach is out of alignment with 
that of its peers. 

Treating the failure of an AML pillar component as an MRA rather than an AML 
violation sends a more muted message about the importance of the AML deficiency and the need 
to correct it in a prompt manner. A matter requiring "attention" simply does not have the same 
urgency as a statutory "violation." In addition, citing a violation of law when one critical 



1/32 7/26/2006 OCC Report of Examination for HBUS, OCC-PSI-00422079, at 2-3 (citing violations of the Equal 
Opportunity Act and Consumer Protections for Depository Institution Sales of Insurance regarding disclosures). 
[Sealed Exhibit.] 

1753 One OCC senior legal counsel specializing in AML matters told the Subcommittee that the OCC "will not cite 
pillar violations" and instead lists them as MRAs which are not enforceable in court. He said that the OCC uses the 
same approach when reporting AML examination findings to FinCEN, describing the OCC's reporting as "cleaner" 
and not "cluttered with component violations" like the other agencies. Subcommittee interview of James Vivenzio 
(3/15/2012). 

1754 See "Federal Banking Agency Bank Secrecy Act Compliance Examination: Consolidated Quarterly Report," 
(2001-201 1), prepared by FinCEN, using data supplied by the OCC, Federal Reserve, FDIC, NCUA and the Office 
of Thrift Supervision, PSI-FinCEN-0063-296; 7/2012 chart, "Bank Secrecy Act Pillar Violations 2007-201 1," 
prepared by the Subcommittee. [Sealed Exhibits.] 
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component of a bank's AML program is inadequate sends a strong message to management that 
its AML program is deficient, does not meet minimum statutory requirements, and requires 
remediation to ensure compliance with all four statutory requirements. 

AML Enforcement Actions at Large Banks. When the OCC identifies AML 
deficiencies at a bank, it can use informal or formal enforcement actions to compel the bank to 
correct the deficiencies and strengthen its AML controls. 

Informal actions include nonpublic commitment letters, board resolutions, or memoranda 
of understanding in which the bank makes written commitments, with fixed deadlines, to take 
specific actions. To take an informal action against a large bank, an Examiner-in-Charge must 
obtain the approval of the Large Bank Supervision Department in Washington. While these 
agreements are not enforceable in court, they can provide quick and effective tools to produce 
reforms. The OCC, however, disfavors the use of informal actions in AML cases, and has taken 
only eight informal enforcement actions against large banks for AML deficiencies since 
2005. 1755 

To take a formal enforcement action against a large bank, such as a Cease and Desist 
Order, the Examiner-in-Charge must submit a recommendation to the OCC's Washington 
Supervision Review Committee (WSRC). The WSRC is comprised of senior managers in the 
agency and acts as an advising body to the Senior Deputy Comptroller. It was established to 
promote consistency in the agency's application of formal enforcement actions. To present a 
recommendation, the Large Bank Supervision Department and the Legal Department prepare 
pertinent examination information and a memorandum for the WSRC. Counsel from the 
Enforcement and Compliance Division also participates. The WSRC ultimately determines 
whether a program violation can be supported and cited, which would also require the OCC to 
issue a Cease and Desist Order. 

According to the OCC, from 2005 to 201 1, the OCC issued 43 Cease and Desist Orders 
against both large and smaller sized banks with AML deficiencies, compared to 2 by the Federal 
Reserve and 52 by the FDIC, and assessed $124 million AML-related civil money penalties, 

1 7^7 

accounting for 62% of the total penalty assessments by federal banking agencies. At the 
same time, the statistics also indicate that the OCC is not resolving AML problems at an early 
stage but, as with HBUS, may be allowing AML problems to accumulate until they necessitate 
severe enforcement action. 

The interagency guidance on AML enforcement provides all federal banking agencies 
with guidelines on the use of formal enforcement actions to ensure bank compliance with AML 
laws, but does not offer any guidance on the use of informal actions. Among other provisions, 
the guidance states that if a Supervisory Letter contains an identical AML violation or MRA that 
was not corrected since the prior examination, typically referred to as a "repeat" violation or 
MRA, the agency must issue a formal enforcement action to require corrective action. 1758 Under 



1/35 Subcommittee briefing by OCC legal counsel (7/13/2012). 

1756 See, e.g., "Process for Taking Administrative Enforcement Actions Against Banks Based on BSA Violations," 
OCC 2005-45, Attachment, Appendix A to OCC 2004-50, OCC-PSI-00 176030. 

1757 Subcommittee briefing by OCC legal counsel (7/14/2012). 

1758 See 7/19/2007 "Interagency Statement on Enforcement of Bank Secrecy Act/Anti-Money Laundering 
Requirements," in the Federal Financial Institutions Examination Council's Bank Secrecy Act/ Anti-Money 
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a 2004 Memorandum of Understanding between FinCEN and federal bank regulators, FinCEN 
must be notified of, among other things, all AML-related formal and informal enforcement 
actions taken with respect to a particular bank. 1759 

B. OCC Oversight of HBUS 

HBUS is located within the OCC's Northeastern District which is currently headed by 
Deputy Comptroller Toney Bland. The OCC Examiner-in-Charge of HBUS was Anthony 
DiLorenzo from 2004 until 2008, when his term expired, and he was replaced by Sally Belshaw. 
Ms. Belshaw served as the HBUS Examiner-in-Charge until December 2010, when she was 
promoted to Deputy Comptroller for Large Bank Supervision. 1760 The current OCC Examiner- 
In-Charge at HBUS is Kris Mclntire. 

(1) Chronology of OCC AML Oversight of HBUS 

The OCC has been the primary regulator of HBUS since July 2004, when it inherited 
oversight of a bank already subject to a formal enforcement action to strengthen its AML 
program. HBUS has been criticized at times for poor AML controls for over the past decade, but 
until 2010, the OCC failed to take any enforcement action to compel the bank to implement an 
effective AML program. 

Inheriting an AML Problem. Over the past 30 years, HBUS, through its predecessor 
banks, has changed its bank charter three times, switching between OCC and Federal Reserve 
oversight in 1980, 1993, and 2004. 1761 The first switch took place in 1980, when HSBC acquired 
51% control over Marine Midland Bank in New York. Marine Midland Bank was then a state- 
chartered bank, a member of the Federal Reserve System, and subject to oversight by both the 
New York State Banking Department and the Federal Reserve. In connection with the 1980 
acquisition, however, it converted its charter to a national bank subject to oversight by the OCC. 
By 1987, HSBC had assumed 100% control of the bank. In 1990, the OCC downgraded the 
bank's CAMELS composite rating, which remained unchanged through 1993. On December 
31, 1993, Marine Midland switched back to a state-chartered bank in New York subject to 
Federal Reserve supervision. After its first examination, the Federal Reserve upgraded its 

.• 1763 

rating. 

Six years later, in 1999, Marine Midland Bank acquired two more banks and renamed 
itself HSBC Bank USA, N.A. (HBUS). In 2003, HBUS was cited by both the Federal Reserve 



Laundering Examination Manual, Appendix R, at R-4 ("Failure to correct a previously reported problem with the 
BSA Compliance Program"). 

1759 See Memorandum of Understanding between FinCEN and bank regulators, 
http://www.ffiec.gov/bsa_aml_infobase/documents/FinCEN_DOCs/Memo_Understand_Sept04.pdf. 

1760 See 12/13/2010 "OCC Announces Changes to the Its Large Bank Supervision Leadership Team," OCC press 
release NR 2010-140, http://www.occ.gov/news-issuances/news-releases/2010/nr-occ-2010-140.html. 

1761 See the Federal Reserve's National Information Center, 

http://www.ffiec.gov/nicpubweb/nicweb/InstitutionHistory.aspx?parID_RSSD=413208&parDT_END=99991231. 

1762 See 1/19/1990 and 5/31/1993 OCC targeted examinations. [Sealed Exhibits.] 

17 3 See 3/3 1/1994 Federal Reserve Bank of New York examination conducted jointly with the New York State 
Banking Department. [Sealed Exhibit.] 
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and New York State Banking Department for maintaining an inadequate AML program. 
Regulators cited fundamental, wide-ranging problems, including ineffective monitoring of wire 
transfers and monetary instruments, ineffective recordkeeping and reporting of currency 
transactions, inadequate customer due diligence and enhanced due diligence, and a failure to 
report suspicious activities. The Federal Reserve noted that AML deficiencies identified in prior 
examinations had not been corrected, that bank management was reactive rather than a proactive 
with respect to its AML program, and that the compliance function had a lack of influence as 
evidenced by ongoing, uncorrected problems. 1765 On April 30, 2003, both regulators entered 
into a formal agreement with the bank requiring it to "upgrade and improve" its AML internal 
controls. 1766 The agreement required: 

"o Development of a compliance program, 
oAn effective system and methodology related to monitoring efforts, 
oA system for evaluating suspicious transactions, 
oA customer due diligence program, and 

oThe development and implementation of appropriate risk assessments." 

On March 22, 2004, while this formal enforcement action was still unfolding, HBUS 
announced its intention to once more seek a national bank charter from the OCC. On July 1, 
2004, after acquiring Republic Bank Delaware, HBUS changed its charter a third time and again 
became a national bank subject to oversight by the OCC. As a condition to approval of its new 
national charter, HBUS agreed to comply with the provisions of the 2003 agreement requiring 
AML improvements. HBUS, thus, began its tenure with the OCC operating under an agreement 
requiring it to address a host of AML deficiencies. 

Terminating the AML Agreement Despite 30 MRAs. The OCC produced its first 
Report of Examination (ROE) for HBUS less than a year later. 1768 The ROE covered 
examinations conducted through March 31, 2005. It noted as the first Matter Requiring 
Attention of the bank its obligation to implement the AML requirements in the 2003 agreement 
and concluded that the bank had made significant progress. The ROE stated that HBUS had 
already "developed a written Anti-Money Laundering (AML) program, including a system of 
internal controls" and established an "AML Oversight and Control Group . . . responsible for 
maintaining enterprise wide AML policies and procedures, identifying red flags and establishing 
transaction monitoring criteria." It stated that the bank had "[implemented controls [that] 
provide for effective monitoring of various transactions throughout all departments of the bank 
... for both non-customers and customers . . . designed to identify unusual and/or suspicious 
activities." It stated that HBUS had "enhanced monitoring abilities through the Customer 
Activity Monitoring Program (CAMP) system." The ROE also stated that HBUS had 
established a "written Customer Due Diligence program" which included procedures to "ensure 
the identification and timely, accurate, and complete reporting of all known or suspected 



1764 See 12/31/2002 Federal Reserve Bank of New York examination conducted jointly with the New York State 
Banking Department. [Sealed Exhibit.] 

1765 Id. 

1766 OCC Report of Examination of HBUS, for the examination cycle ending March 31, 2005, OCC-PSI-00 107637, 
at 10-11 (describing the formal agreement). [Sealed Exhibit.] 

1767 Id. at 10. 

1768 Id. 
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violations of law against or involving the bank, to law enforcement and supervisory authorities." 
It said that HBUS had also "created risk rating criteria to identify categories of customers whose 
transactions and banking activities pose heightened risk of money laundering and other illegal 
activities." It noted that the bank operated an Investigative Control and Reporting Office and a 
Financial Intelligence Group to conduct enhanced due diligence. 

The ROE concluded: "OCC examiners reviewed compliance with the agreement, and 
found the bank to be in technical compliance with the requirements." It said that termination of 
the formal agreement would be considered following targeted AML examinations of certain high 
risk areas in the bank. 1769 Given the breadth and depth of the AML problems depicted in the 
2003 agreement signed less than a year earlier and the relatively short time that the bank had to 
correct its AML deficiencies, the ROE's positive statements were surprising. 

Over the next year, until early 2006, OCC AML examiners completed seven AML 
examinations at HBUS. The examinations reviewed multiple HBUS departments with higher 
risk activities, including Embassy Banking, Global Banknotes, Foreign Correspondent Banking, 
wire transfers, and International Private Banking. Each of the examinations identified significant 
AML deficiencies. The problems included noncompliance with the bank's AML policies (4 of 7 
exams), weak monitoring procedures (5 of 7), weak customer due diligence procedures (5 of 7), 
inadequate written policies requiring revision (6 of 7), and untrained staff (5 of 7). For example, 
the examination of the Global Banknotes department found that customer information was 
missing from a number of files and that a number of banknotes clients were not being monitored 

1770 

at all. The examination of the bank's wire transfer operations found that monitoring was 
being conducted on a manual rather than automated basis, and identified one trust account that 
"had a significant amount of wire transfer activity in a short period of time and involved wire 
transfers to entities and/or individuals from high risk geographies," had undergone no 

1 77 1 

monitoring, and whose accountholder had not received an enhanced due diligence review. 

The examination of the Embassy Banking department found over a dozen incidents of suspicious 

activity involving one embassy account over eight months, yet the bank had failed to close the 

1 779 

account, despite an HBUS policy requiring closure in that circumstance. The International 
Private Bank examination found 540 high risk accounts that needed annual reviews that had yet 
to be completed; account reviews whose conclusions were not consistently supported; and high 
risk bearer share accounts whose shares were not under bank control and posed a risk that the 

1773 

bank was unaware of the true account owners. 



When viewed together, the examinations identified systemic AML problems, a situation 
consistent with the extensive AML enforcement action instituted by the Federal Reserve and 



1770 6/20/2005 OCC Supervisory Letter to HBUS on Global Banknote Examination, OCC-PSI-00 107505. [Sealed 
Exhibit.] 

1771 1/23/2006 OCC Supervisory Letter to HBUS on Wire Transfer Examination, OCC-PSI-00 107522. [Sealed 
Exhibit.] 

1772 1 1/23/2005 OCC Conclusion memorandum "BSA/AML Examination - HSBC USA International Private 
Bank," OCC-PSI-01258252; 1/30/2006 OCC Supervisory Letter to HBUS on Embassy Banking Examination, OCC- 
PSI-00 107529. [Sealed Exhibits.] 

1773 1/31/2006 OCC Supervisory Letter, "International Private Banking BSA/AML Examination," OCC-PSI- 
00107537-542. [Sealed Exhibit.] 
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New York Banking Department. Many of the problems cited in the OCC examinations, 
including weaknesses in customer due diligence and monitoring, were prominent features of the 
2003 agreement. In response to the AML examination findings, the OCC Examiner-in-Charge 
sent Supervisory Letters which, together, identified 30 Matters Requiring Attention (MRAs) 
requiring corrective action by HBUS. 1774 Despite issuing over 30 MRAs in just over 12 months, 
on February 6, 2006, the OCC determined that the condition of the AML agreement had been 
met and terminated the agreement. 1775 

AML Deficiencies Continue. On July 26, 2006, the OCC provided HBUS with another 

1 77/^ 

annual Report of Examination covering the period up to March 31, 2006. In the section 
entitled, "Matters Requiring Attention," the ROE included AML matters as an MRA, but 
provided this mixed message about the state of HBUS' AML program: 

"During the year, we identified a number of areas lacking consistent, vigilant adherence 
to BSA/AML policies, and provided management with supervisory letters addressing 
specific areas in need of strengthening. Bank policies are acceptable. Management 
responded positively and initiated steps to correct weaknesses and improve conformance 

1 777 

with bank policy. We will validate corrective action in the next examination cycle." 

Later in the report, in the section discussing the bank's "Consumer Compliance Rating," the 
ROE stated that HBUS had "a satisfactory BSA compliance program," that its controls were 
generally effective, and "no violations of law were noted." It also stated: "However, each 
examination resulted in MRAs, typically non-adherence to internal policies and procedures .... 
This recurring pattern is listed as a Matter Requiring Attention in this Report of 

1778 

Examination." The ROE also criticized an internal group dedicated to testing AML 



1774 The 30 MRAs required corrective action to address weak AML monitoring procedures, weak AML due 
diligence, inadequate AML training, and inadequate AML policies. Monitoring problems were noted, for example, 
in all four Supervisory Letters issued in January 2006. See 1/17/2006 OCC Supervisory Letter to HBUS on Foreign 
Correspondent Banking, OCC-PSI-00000295-301, at 299-300 (Monitoring is weak and is not detecting patterns of 
activity "below system parameters" and monitoring wire transfers is a "manual process and therefore subject to 
inefficiencies and potential errors"); 1/23/2006 OCC Supervisory Letter to HBUS on Wire Transfers, OCC-PSI- 
00107522-528, at 526 ("[T]he effectiveness of automated monitoring through CAMP is diminished in the absence of 
effective investigations of alerts that the system generates."); 1/30/2006 OCC Supervisory Letter to HBUS on 
Embassy Banking, OCC-PSI-00107529-536, at 534 ("Embassy Banking Compliance management must ensure that 
high-risk and Special Category of Client (SCC) accounts are monitored and reviewed on a consistent and frequent 
basis."); 1/31/2006 OCC Supervisory Letter, "International Private Banking BSA/AML Examination," OCC-PSI- 
00107537-542, at 540-541 ("Management must establish standards for CAMP alert reviews that require well- 
documented reasons for conclusions... [E]xisting policies and procedures governing PUPID do not provide for 
adequate identification, monitoring and controlling of the risk inherent in such activity .... [T]here are no procedures 
in place to ensure activity logs are kept current on a scheduled basis. To effectively manage, monitor and report the 
potential risks associated with PUPID activity, logs must be revised to distinguish funds transfers payable to the 
account holder initiating the transfer, from those payable to a third-party non-account holder."). 

1775 7/26/2006 OCC Report of Examination of HBUS, for the examination cycle ending March 31, 2006, OCC-PSI- 
00422079, at 5. [Sealed Exhibit] 

1776 7/26/2006 OCC Report of Examination of HBUS, for the examination cycle ending March 31, 2006, OCC-PSI- 
00422079. [Sealed Exhibit.] 

1777 Id. at 2. 

1778 Id. at 12. 
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compliance, the Compliance Review Unit, which, according to the ROE, was understaffed, 
performed weak analysis, and needed to be revamped. 

HBUS' typical response to these examinations was to develop AML policies and 
procedures in response to the specific AML problems identified by the OCC. Those policies and 
plans often were narrowly targeted, and later examinations found that bank personnel sometimes 
failed to implement or comply with them. 

A year later, on July 24, 2007, the OCC's annual Report of Examination contained a 
more negative assessment. This report covered examinations conducted through March 31, 
2007. The letter transmitting the ROE stated: 

"A number of business areas continue to lack vigilant adherence to BSA/AML policies. 
Supervisory letters issued during the year highlighted a number of thematic deficiencies 
in the execution of BSA/AML policies and procedures at the business level. 
Management continues to respond positively to correct weaknesses noted, and to improve 
conformance with bank policy. However, it remains critical that sound policies adopted 

1780 

by the Board and management are executed consistently in the business lines." 

In the report itself, the section entitled, "Matters Requiring Attention," included this MRA: 

"During the past year, examiners identified a number of common themes in that 
businesses lacked consistent, vigilant adherence to BSA/AML policies. Bank policies are 
acceptable; however, the execution of these policies in the various business lines requires 
strengthening. Management continues to respond positively and initiated steps to 
improve conformance with bank policy." 1781 

The MRA, which called for "strengthening" the "execution" of AML policies in "the various 
business lines," provided a general instruction to pay more attention to AML compliance. 

A second MRA was more specific and issued a warning about the need to strengthen 
AML controls on HBUS pouch services, meaning bank services to clear monetary instruments 
from abroad, including bank checks, money orders, and travelers cheques. 1782 The MRA stated 
that pouch services "facilitate easy movement of funds, and are favored by persons who transfer 
illegal and terrorist funds." It noted that pouch services were being provided by multiple HBUS 
business lines. The ROE described the pouch examination as having "resulted in serious 
concerns related to weak policies, procedures, systems and controls ... inferior to BSA/AML 
controls in other areas of the bank." The ROE also stated that "remedial attention is warranted," 



1779 7/24/2007 OCC Report of Examination of HBUS, for the examination cycle ending March 31, 2007, OCC-PSI- 
00304077. [Sealed Exhibit.] 

1780 Id. at 2. 

1781 Id. all. 

1782 Id. 
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and warned that ongoing inadequate AML controls over pouch activities "could potentially 
subject the bank to undue reputation risk and/or lead to BSA/AML violations." 1783 

By the end of 2007, the OCC completed 21 AML examinations, many of which 
identified serious AML problems. 1784 Many of these examinations identified the same serious 
problems noted in earlier examinations, some of which cut across business lines. The 
examinations include AML issues in the London Banknotes office, Corporate and Institutional 
Banking, Retail Banking, Pouch Services, and Investment Banking. The examination that 
identified the most serious AML deficiencies, and which was included as an MRA in the annual 
ROE, related to pouch services which seemed to be operating without any AML controls. The 
pouch examination cited insufficient AML policies and procedures, a lack of monitoring for 
suspicious activities, inadequate AML controls and training, and inadequate independent testing 
of pouch services for AML compliance. Examples of potentially suspicious activity included 
sequentially numbered travelers cheques endorsed by the same exchange house and processed 
through several cash letters; a transaction that included a starter check for $105,000; and 
$130,000 in sequentially numbered travelers cheques presented in bearer form with the payee 
line left blank. OCC examiners initially recommended that a formal enforcement action be 
taken to effect corrective action in the pouch area, but no formal or informal action was 



The 21 examination reports and the Supervisory Letters that followed identified 
numerous AML deficiencies, including noncompliance with bank policy, poor monitoring, weak 
to nonexistent due diligence reviews, inadequate policies requiring revision, and untrained staff. 
Altogether, from February 2006 to December 2007, the Supervisory Letters identified another 34 
AML MRAs, but no violations were identified or enforcement actions taken. 

AML Deficiencies Displaced by Financial Crisis. On July 15, 2008, the OCC issued its 
annual Report of Examination for HBUS, summarizing examination activity conducted through 



Id. See also the discussion of the bank's Consumer Compliance Rating, at 12. 

1784 Eight of the 21 examinations were limited to following up on corrective actions promised earlier, all of which 
were found to have been carried out. 

1785 2/23/2007 OCC "Conclusion memorandum for HSBC Middle Market BSA/AML Examination," OCC-PSI- 
01263216; 4/10/2007 OCC Conclusion memorandum "BSA/AML Examination - HSBC, USA, NA - Pouch 
Activities", OCC-PSI-00899202 (reviewing pouch activities at the International Private Bank, Domestic Private 
bank, retail banking, and Payments and Cash Management business units). [Sealed Exhibits.] 

1786 Id. at 208. 

1787 Subcommittee interview of Joseph Boss (1/30/2012), Elsa de la Garza (1/9/2012), and Anthony DiLorenzo 
(3/22/2012). Upon receipt of the recommendation, the Examiner-in-Charge asked the AML examiners to prepare an 
analysis of whether the proposed enforcement action, a Cease and Desist Order, met OCC enforcement standards. 
The AML examiners concluded that, despite the serious AML deficiencies, the problems in the pouch area did not 
rise to the level of a violation of law and would be applied to a bank with a high composite rating for safety and 
soundness, and so did not meet OCC standards for issuing a Cease and Desist Order. See 6/13/2007 OCC 
memorandum, OCC-PSI-01298625; 7/3/2007 OCC memorandum OCC-PSI-00877731. [Sealed Exhibits.] One 
examiner told the Subcommittee that although the pouch activity did not meet OCC enforcement standards, he felt a 
Cease and Desist Order was nevertheless warranted at the time. Subcommittee interview of Joseph Boss 
(1/30/2012). The deputy head of Large Bank Supervision told the Subcommittee that she did not recall being 
informed about the enforcement recommendation or seeing the Conclusion Memorandum that laid out the problems 
in the pouch area at HBUS. Subcommittee interview of Grace Dailey (6/15/2012). 
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March 31, 2008. Despite referencing a troubling AML examination involving the bank's 
Embassy Banking department, described below, for the first time since 2004, the ROE did not 
contain any MRA related to AML concerns. This development may have been due, in part, to 
the deepening financial crisis then sweeping the U.S. financial system, raising questions about 
virtually every major financial institution. HBUS' AML issues may have been displaced by 
OCC efforts to analyze the bank's safety and soundness, including each of its CAMELS 
components. Nevertheless, the ROE did reference ongoing AML concerns at the bank. 

The OCC letter transmitting the ROE included this paragraph about AML issues: 

"Although BSA/AML internal systems and controls are generally effective, the 
examination of the Government and Institutional Banking (GIB) operations disclosed a 
number of significant . . . compliance concerns. Management developed a plan to address 
the issues, and we are presently validating that the actions taken are addressing our 
concerns." 



Although the ROE contained no MRA related to AML concerns, in the section discussing 
HBUS' composite rating, the ROE again referenced the examination that uncovered serious 
AML deficiencies in the GIB department: 

"Our examination of BSA/AML practices in the Government and Institutional Banking 
(GIB) department during the first quarter of 2008 resulted in a number of concerns 
including: inconsistent adherence to internal policies and procedures, inadequate 
systems, the need to strengthen controls, and inconsistent monitoring processes. 
Management is aware of the deficiencies and developed a plan to address the issues. We 
are in process of validating that the corrective action plan addresses our concerns 
satisfactorily." 1790 

Although these AML deficiencies were discussed in the composite rating section, there is no 
indication they affected the rating which remained unchanged from the prior year. 

AML issues were discussed a third time in the section of the ROE analyzing HBUS' 
Consumer Compliance Rating. For the first time, this section included a lengthy discussion of 
the high AML risks incurred by HBUS' banking operations. The ROE stated: 

"BSA/AML examinations were conducted in Middle Market, Government and 
Institutional Banking, Corporate Trust, Investment Banking, Customer Activity 
Monitoring Program, and London Banknotes follow-up. . . . 

HBUS is the largest Embassy banking services provider. The bank is also active in the 
precious metals, jewelry, garment, and Middle Eastern carpets industries. HBUS has 
numerous accounts to Politically Exposed Persons and Money Service Businesses. The 
bank ranks in the top three banks in CHIPS and SWIFT wire transfer volume, and is a 



1/ss 07/15/2008 OCC Report of Examination of HBUS, for the examination cycle ending March 31, 2008, HSBC 
OCC 3601 1 19. [Sealed Exhibit.] 
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leader in global foreign correspondent relationships. As the U.S. dollar clearing bank for 
the Global HSBC network, HBUS maintains numerous relationships with institutions 
worldwide. . . . The bank does business with numerous customers in both High Intensity 
Drug Trafficking Area and High Intensity Money Laundering and Related Financial 
Crime Area locations. HBUS provides pouch services through several business units. 
Historically, pouch services are vulnerable to money laundering risk." 1791 

Despite this recitation of the AML risks facing HBUS, the ROE stated that the bank's AML 
controls were "generally effective, with no violations noted." It also stated that "certain areas 
within GIB required strengthening." 

Embassy Banking Examination. The ROE's multiple references to GIB, the 
Government and Institutional Banking department that housed the bank's Embassy Banking 
services, were included, because in January 2008, former GIB employees alerted the OCC to a 
host of problems in the Embassy Banking unit. HBUS had dramatically increased its Embassy 
Banking business, after the closure of Riggs Bank and the decision by Wachovia Bank to exit the 
business. 1793 By January 2006, the bank had over 2,500 embassy accounts with $485 million of 
deposits under management, 1794 and the business continued to grow. The former employees 
described numerous problems, including apparent employee misconduct, inappropriate business 
transactions, noncompliance with bank policy, inadequate account monitoring, and erroneous 
and misleading regulatory and internal reports. 

Over the next few months in 2008, an OCC examination confirmed the allegations. 1795 
The examination found, for example, that GIB had allowed two high risk embassy accounts 
involving Libya and Saudi Arabia to operate outside of restrictions specified in Memoranda of 
Understanding (MOU) established for each Embassy relationship. The examination found 
unacceptable levels of risk, inadequate account monitoring, and suspect transactions. One 
example involved a $20 million wire transfer that was variously explained as needed to pay the 
expenses of Libyan prisoners in the United States and elsewhere, or for "legal expenses and 
consultation that will lead to the establishment of a bilateral agreement with the US for 
cooperation on judicial affairs that related to future prisoner transfers." 1796 The examination 
reported that when HBUS Compliance asked an Embassy Relationship Manager for information 
about one of the high risk accounts, it received insufficient explanations and, in some cases, the 
Relationship Manager took up to four months to obtain client responses. 



1791 Id. at 13-14. 

1792 Id. at 13. 

1793 See 1/30/2006 OCC Supervisory Letter regarding HBUS Embassy Banking, OCC-PSI-00 107529-736, at 529- 
530; "HSBC to Open D.C. Branch, Pursue Embassy Clients," Washington Post, Terence O'Hara 

(1 0/5 /2004)(quo ting Riggs spokesperson: "As a service to our remaining embassy clients, Riggs is working closely 
with HSBC to ensure a smooth transition."), http://www.washingtonpost.com/ac2/wp-dyn/A7285- 
2004Oct4?language=printer. 

1794 1/30/2006 OCC Memorandum, "4Q05 Embassy Banking Examination," OCC-PSI-00107529; 1/30/2006 OCC 
Supervisory Letter to HBUS, OCC-PSI-00107529. [Sealed Exhibit.] 

1795 10/8/2008 OCC Memorandum, "Royal Embassy of Saudi Arabia (RESA) March 2008 Examination 
Conclusions," OCC-PSI-01434609; 4/3/2008 OCC Memorandum "Libyan Relationship Review," OCC-PSI- 
01434593; 5/20/2008 OCC Memorandum, "Government and Institutional Banking," OCC-PSI-00899215. 

1796 4/3/2008 OCC Memorandum "Libyan Relationship Review," OCC-PSI-01434593, at 5. 
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In addition, the examination found that Embassy Banking had been opening new 
accounts without notifying HBUS AML Compliance, which was against bank policy and led to 
unmonitored account activity. The OCC determined that two of five accounts opened for one 
high risk embassy relationship had not been disclosed to AML Compliance. It found that over 
45 letters of credit for other Embassy Banking clients, ranging in amounts from a few thousand 
dollars to $3 million, were also undisclosed. Another problem was that Embassy Banking was 
executing transactions for persons who were not clients - so-called PUPID transactions that were 
Payable Upon Proper Identification - without logging in some of the transactions and without 
screening the transaction beneficiaries against OFAC's SDN list, in contravention of U.S. law. 
Still another problem was that Embassy Banking personnel had identified multiple instances of 
suspicious activity involving some accounts, but had not closed the accounts, despite an HBUS 
policy requiring closure under those circumstances. The OCC also identified a backlog of over 
3,000 unreviewed alerts, some dating back to 2007, relating to potentially suspicious transactions 
in Embassy accounts. 

The OCC examiner concluded that GIB's "AML program is not effective in identifying 
and mitigating risk, especially considering the nature of its clientele and the types of products 
and services it provides." The examiner recommended issuance of a Cease and Desist Order 
requiring immediate corrective action and prohibiting new Embassy Banking accounts until 
AML controls were in place. The OCC decided, however, not to issue a Cease and Desist Order 
or take any other informal or formal enforcement action with respect to the Embassy Banking 
accounts. In May 2008, HBUS submitted an action plan to the OCC and began addressing 
the AML deficiencies at GIB. A later examination was conducted to determine whether the GIB 
commitments were carried out and found that they were. In July 2008, the Report of 
Examination sent to HBUS acknowledged the AML deficiencies uncovered in Embassy 
Banking, but did not treat them as a Matter Requiring Attention by the HBUS board. 

AML Deficiencies Continue Amid Law Enforcement Inquiries. On July 6, 2009, the 
OCC sent HBUS the annual Report of Examination covering the period up to March 31, 
2009. 1799 Like the prior year's ROE, it contained no Matter Requiring Attention related to AML 
issues. The letter transmitting the ROE noted, however, that AML concerns were ongoing 
nonetheless: 

"Compliance with BSA/AML remains a high priority and a key reputation risk. As part 
of the 'compliance transformation project,' this area is also undergoing significant 



5/20/2008 OCC Memorandum, "Government and Institutional Banking," OCC-PSI-00899225. 

1798 The AML examiner told the Subcommittee he was not given any reason for OCC's inaction in this matter, but 
was simply told there would be no enforcement action. He said it was his understanding that the Examiner-in- 
Charge had discussed the matter with the deputy head of Large Bank Supervision in Washington before telling him: 
"Grace said there would be no C&D." Subcommittee interview of Joseph Boss (1/30/2012). The Examiner-in- 
Charge told the Subcommittee that he did not recall talking to a superior about the matter, but thought he "probably 
did because it was a significant issue." Subcommittee interview of Anthony DiLorenzo (3/22/12). The deputy head 
of Large Bank Supervision did not recall having a discussion about a Cease and Desist Order involving Embassy 
Banking at HBUS. Subcommittee interview of Grace Dailey (6/15/12). 

1799 6/07/2009 OCC Report of Examination of HBUS, for the examination cycle ending March 31, 2009, OCC-PSI- 
00270034. [Sealed Exhibit.] 
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change. The company has high-risk clients and businesses and the current leadership 
needs to be strengthened. Plans are underway to address this concern." 1800 

This letter was the first to be signed by Sally Belshaw, who had replaced Anthony DiLorenzo as 
the OCC Examiner-in-Charge at HBUS, upon conclusion of Mr. DiLorenzo' s five-year term. It 
was the fifth in a row to identify AML compliance as a high priority issue. 

For the first time, the ROE contained a "Risk Assessment Summary" table which 
included a reference to AML issues. The table indicated that AML risk was "High," AML risk 
management was "Satisfactory," and the aggregate AML risk at HBUS was "High" and 
"Stable." 1801 



Later in the report, in the section discussing the bank's "Consumer Compliance Rating," 
the ROE stated that HBUS' compliance risk was "high due to the bank's lines of business which 
offer several products historically associated with money laundering." It repeated much of the 
language from the last ROE describing the bank's high risk businesses and customers. It also 
indicated that HBUS needed to strengthen its AML leadership: 

"Although the BSA/AML program is effective overall, we recently highlighted the need 
to strengthen leadership in the area. When the BSA Director resigned in 2007 the role of 
the HBUS Compliance Director was expanded to include oversight of the BSA/AML 
program. The current Compliance Director has been in place since second quarter 2008. 
In addition to BSA responsibility in the U.S., the Compliance Director also has 
responsibility for Canada, Mexico and the Securities businesses. We believe that a 
complex, high-risk institution like HBUS needs a BSA/AML Officer who is highly 
qualified and experienced and have recommended that such a person be dedicated to the 
function. A search is underway." 

The discussion of AML leadership was prompted by the 2007 departure of HBUS' AML 
head Teresa Pesce after four years on the job, followed by the departure of the head of HBUS 
Compliance, Carolyn Wind after seven years on the job. After Ms. Pesce left, Ms. Wind had 
served as both Compliance and AML head. Leslie Midzain was then hired to serve in both roles 
as well, serving as the bank's AML head even though her background was in Canada and she 
had no U.S. AML experience. In 2010, the OCC would ask for her replacement due to her lack 
of AML expertise and would also criticize the weak AML leadership shown by the regional 
Compliance head, Janet Burak. In addition to AML leadership problems, the ROE noted that 
HBUS Compliance was undergoing a reorganization, and that the Compliance Review Unit, 
originally dedicated to AML independent testing, was also being reorganized and its mission 
expanded to other compliance issues. 

During 2008, the OCC completed six more examinations, one of which focused on 
reviewing corrective actions to prior problems. Of the remaining five, one involved additional 



1800 Id. 

1801 Id. 

1802 Id. 
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at 2. 
at 16. 
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work on the AML deficiencies at GIB's Embassy Banking unit. Another focused on AML 
issues affecting the Payments and Cash Management (PCM) department which helped provide a 
variety of cash services to clients, including correspondent accounts. 1804 The PCM examination 
found fundamental flaws in its AML controls, including inadequate monitoring, poor review of 
account alerts, and suspicious transactions involving money service businesses. The PCM 
examination found, for example, that PCM "systems and controls are less than satisfactory and 
do not provide an appropriate level of monitoring for suspicious and unusual activity for all of 
the activities in the business unit." One example involved an account alert which found that a 
U.S. money service business was sending wire transfers through its HBUS correspondent 
account to an Ethiopian bank for credit to an account it held at that bank, in effect sending 
money to itself. The alert was reviewed, PCM personnel determined more information was 
needed, but the alert was closed and the transactions continued. 

Similar problems had been identified in a 2006 OCC examination of foreign 
correspondent banking which resulted in an MRA requiring PCM to conduct a review of its 
money service business accounts. As a result of the 2008 examination, OCC examiners 
recommended three MRAs, one of which directed PCM to conduct a review of its money service 
business accounts, which appears to be a "repeat MRA" from the 2006 examination. Several 
months later, the OCC Examiner-in-Charge sent a Supervisory Letter to HBUS including the 
three MRAs, but did not characterize the request for an account review as a "repeat MRA" that 
would necessitate an enforcement action, instead referring to "PCM's delay in initiating a special 
review for Money Services Businesses (MSB) type of entities, as required by a previous MRA, 
has resulted in increased risk." 1805 



A third examination in 2008, focused on HBUS Compliance Review Unit (CRU) which 
was dedicated to reviewing AML compliance at the bank. The examination found its work 
satisfactory but also directed HSBC's internal audit unit to test the CRU's workpapers for 
reliability and directed the CRU to conduct an immediate review of the PCM department which 
had not undergone an internal AML review for over three years. 1806 Additional examinations 
focused on AML issues at Card Services and Banknotes offices in Singapore and Hong 
Kong. 1808 

In 2009, the OCC conducted eight more AML examinations. Three followed up on the 
problems uncovered in connection with HBUS' pouch activities, Embassy Banking and PCM 
services. 1809 Additional examinations assessed HBUS' OFAC compliance 1810 and AML controls 



18UJ 8/14/2008 OCC Memorandum, "Government and Institutional Banking Update," OCC-PSI-00899227; 9/4/2008 
OCC Supervisory Letter to HBUS on GIB examination, OCC-PSI-00107607. [Sealed Exhibit.] 

1804 12/7/2007 OCC Memorandum, "BSA/AML Examination - Payment and Cash Management," OCC-PSI- 
01263586. [Sealed Exhibit.] 

1805 4/21/2008 OCC Supervisory Letter HSBC-2007-24, "Payment and Cash Management BSA/AML Examination," 
OCC-PSI-00107597. [Sealed Exhibit] 

1806 4/9/2008 OCC Supervisory Letter to HBUS on CRU examination, OCC-PSI-00 107594. [Sealed Exhibit.] 

1807 2/11/2008 OCC Memorandum, "Card Services Compliance Examination," OCC-PSI-00938171. 

1808 6/2/2008 OCC Memorandum, "Singapore/Hong Kong Banknotes Examination," OCC-PSI-00 107603. 

1809 1/22/2009 OCC Supervisory Letter HSBC-2008-16, "Pouch Service BSA/AML Examination," OCC-PSI- 
00107615; 6/24/2009 OCC Supervisory Letter HSBC-2009-10, "Global Institutional Banking BSA/AML 
Examination," OCC-PSI-00 107628. [Sealed Exhibits.] 
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involving correspondent banking and private banking. Those examinations identified 
additional AML problems. For example, the private banking examination concluded: "HSBC's 
Private Bank BSA/AML does not adequately manage the risks associated with DPB-NY/CA 
[Domestic Private Bank offices in New York and California] and IPB-NY [International Private 

1813 

Bank in New York]." Supervisory Letters sent to HBUS described the AML problems, some 
of which had been detected in a 2006 examination of private banking, but made no mention of 
repeat MRAs that would require an enforcement action. 

Altogether in 2008 and 2009, the Supervisory Letters identified 12 more MRAs in the 
AML field, but no informal or formal enforcement actions were taken. These 12 MRAs were on 
top of the 71 MRAs identified from 2005 to 2007. 

In the spring of 2009, a new development intensified OCC's focus on AML problems at 
HBUS. The OCC was contacted by two federal law enforcement agencies regarding separate 
federal investigations into possible money laundering through accounts at HBUS. The first 
contact, in June 2009, was from the U.S. Department of Homeland Security's Immigration and 
Customs Enforcement (ICE) unit investigating possible laundering of illegal drug proceeds. 1814 
The second contact, around August or September 2009, was from a U.S. Assistant Attorney 
General in West Virginia investigating a Medicare fraud. 1815 

Senior OCC officials in Washington arranged to meet with the ICE representatives. On 
September 1, 2009, the meeting took place in Washington and was attended by the OCC Deputy 
General Counsel Daniel Stipano, Deputy Controller in charge of Large Bank Supervision Grace 
Dailey, OCC senior legal counsel with AML expertise James Vivenzio, the OCC AML 
examiners at HBUS, and the ICE representatives. After the meeting concluded and the ICE 
representatives left, OCC personnel continued to discuss supervision of HBUS. According to a 
memorandum summarizing the meeting, the lead AML examiner at HBUS informed the other 
meeting participants that, during his tenure at the bank, HBUS had been the subject of 83 AML- 
related MRAs, and he had twice recommended issuance of a Cease and Desist Order to compel 

1 Q 1 7 

the bank to strengthen its AML controls. According to the meeting memorandum, Mr. 



181(1 1/20/2009 OCC Supervisory Letter HSBC-2008-41, "Office of Foreign Asset Control Examination," OCC-PSI- 
00000434. [Sealed Exhibit.] 

1811 3/3/2009 OCC Supervisory Letter HSBC-2008-34,"Correspondent Banking BSA/AML Examination," OCC- 
PSI-00107618. [Sealed Exhibit.] 

1812 3/18/2009 OCC Supervisory Letter HSBC-2008-32, "Private Banking BSA/AML Examination," OCC-PSI- 
00000445; 9/19/2008 OCC Memorandum "HSBC BSA/AML Private Bank Exam-File Review-Draft," OCC-PSI- 
01274467. [Sealed Exhibits.] 

1813 Id. 

1814 See 9/29/2009 email exchanges between OCC Jim Vivenzio, OCC Joseph Boss, OCC Teresa Tabor, OCC Sally 
Belshaw and others, "HSBC," OCC-PSI-00928756. 

1815 Subcommittee briefing by OCC (3/15/2012). 

1816 See 9/29/2009 email exchanges between OCC Jim Vivenzio, OCC Joseph Boss, OCC Teresa Tabor, OCC Sally 
Belshaw and others, "HSBC," OCC-PSI-00928756-758. 

1817 9/l/2009 Memorandum to Files from OCC Examiners Joseph Boss and Elsa de la Garza, OCC-PSI-01416833. 
See also Subcommittee interview of Elsa de la Garza (1/9/2012), Joseph Boss (1/30/2012), and James Vivenzio 
(3/15/2012). 
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Stipano "stated that he was unaware of the recent history of HBUS and that he wanted a 
thorough review." 1818 

After this meeting, the OCC directed its AML examiners to draw up an investigative plan 
and expand an ongoing AML review to encompass a comprehensive review of the entire AML 
program at HBUS. On September 3, 2009, the OCC sent a letter to HBUS informing it that a 
regularly scheduled AML examination of the Banknotes department that started in July and for 
which field work was completed in August 2009, was being expanded. 1819 Additional staff was 
added to the AML team. 

Expanded AML Examination. For the first time since the OCC inherited HBUS from 
the Federal Reserve, it directed its AML examiners to conduct a holistic review of HBUS' AML 
program, instead of focusing on AML issues in particular banking services or departments. The 
AML examiners quickly found fundamental problems related to the specific AML deficiencies 
identified over the years. This examination would continue throughout 2010. 

In March 2010, the OCC issued its first AML-related Supervisory Letter that cited HBUS 
for a violation of law, for failing to file Suspicious Activity Reports (SARs) in a timely 
manner. 1820 The Supervisory Letter stated that its AML examination had found that the bank had 
a backlog of over 17,000 alerts, in four business units, identifying potentially suspicious activity 

1 821 

that had not been investigated to determine whether a SAR should be filed. The OCC 
determined that 98% of those alerts were generated in the "High Risk Monitoring Group," and 

1822 

14% were six months or older. The OCC gave the bank a deadline of June 30, 2010, to clear 
the backlog and instructed the bank to develop a risk-based system for reviewing and resolving 
those alerts. In addition to the backlog of alerts, OCC examiners had found significant backlogs 
in the bank's handling of AML-related subpoenas and Section 314(a), and 314(b) requests for 
information from other banks, though those items were not specifically discussed in the 
Supervisory Letter. 1823 

Shortly after delivering the Supervisory Letter, the OCC Examiner-in-Charge for HBUS 
Sally Belshaw and the head of Large Bank Supervision Grace Dailey met with the HSBC Group 
CEO Michael Geoghegan and the HNAH and HBUS CEO Brendan McDonough on April 20, 
2010. In that meeting, the OCC officials informed the bank officials that the agency had 
identified serious AML deficiencies throughout the bank. According to a memorandum prepared 
by Ms. Belshaw summarizing the meeting, the discussion included the following: 



1818 9/01/2009 Memorandum to Files from Examiners Boss and de la Garza, at OCC-PSI-01416833. [Sealed 
Exhibit.] 

1819 On 9/21/2009, the OCC sent HBUS a request letter for an extensive amount of new information on 25 Latin 
America-based institutions. There would be eight additional requests for more information through early February 
2010. See 2/6/2010 HBUS email from Janet Burak to Brendan McDonagh, OCC-PSI-00787479. 

1820 3/10/2010 OCC Supervisory Letter HSBC 2010-03, "Backlog of Monitoring Alerts and Enhanced Due diligence 
Requests," OCC-PSI-00851542. [Sealed Exhibit.] 

1821 Id. 

1822 4/28/2010 Report of Examination of HBUS, for the examination cycle ending December 31, 2009, OCC-PSI- 
00899872, at 7. [Sealed Exhibit.] 

1823 See "Background Information on HSBC's Alert Backlog as of the week of February 8, 2010," prepared by OCC, 
OCC-PSI-01358494. 
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He [Mr. Geoghegan] asked when I thought things went bad. Grace and I described the 
spotty history of the bank relative to BSA/AML compliance. The bank converted to a 
national charter with a Formal Agreement (Fed) that they addressed. We also noted the 
regular and frequent citing over the years of MRAs in almost every examination we 
conducted. In those cases, management reacted to our findings and took corrective 
action. This, however, culminated in a systemic concern that we ultimately characterized 
as ineffective management (BSA/AML officer last year and now the compliance program 
overall). We believe that over the years, the people and program did not advance to keep 
pace with the risk. Systems enhancements are only now being achieved (and moved up in 
light of our concerns). Talent left the organization and was not replaced by people with 
sufficient technical skills to lead. Succession/bench strength for the compliance area is 
now inadequate. MIS has not evolved to permit early identification of risks/concerns. 
The backlog issue is a symptom of these management weaknesses. . . . 

We discussed several areas in some specificity including HBUS' policies/practices with 
respect to monitoring of affiliate activity (should be to same, not lesser, standard than 
other correspondents as is currently the case). We highlighted findings of weakness in 
KYC in several areas: bank notes, wire activity, domestic & international customers. We 
highlighted our recent concerns/questions about management's ability to address the 
backlog problem (and violation) given weaknesses we are seeing in data integrity in 
reports, quality of alert dispositioning, and the lack of independent review/oversight of 
that process. Our supervisory letter requires that backlogs be completely corrected by 
June 30 th . We emphasized that not only must the number be addressed, but they must be 
effectively dispositioned (qualified reviewers guided by appropriate policy/process, 
adequate documentation, appropriate/timely SARs filed), and an ongoing system of 
controls must be in place to ensure the process is sustainable. We will be requiring 
qualified, independent verification of that as part of the process. 

2010 Report on Examination. On April 28, 2010, three months earlier than normal, the 
OCC delivered its annual Report of Examination (ROE) to HBUS, covering the period up to 
December 31, 2009. 1825 Like the Supervisory Letter, this ROE cited HBUS for violating the 
Bank Secrecy Act due to its failure to file timely SARs, the only violation listed. 1826 The letter 
transmitting the ROE stated: 

"Perhaps most disconcerting, we have identified significant weaknesses in compliance, 
particularly in Bank Secrecy Act/ Anti-Money Laundering (BSA/AML), that are likely to 
have costly financial and reputation implications. Management is responding to the 
concerns we are raising, but was not effective in preventing these weaknesses from 
becoming serious problems. ... An extended examination is revealing serious 



1824 4/20/2010 OCC Memorandum, "Meeting w/ Michael Geoghegan and Brendan McDonough," OCC-PSI- 
00905522. 

1825 4/28/2010 Report on Examination of HBUS, for the examination cycle ending December 31, 2009, OCC-PSI- 
00899872 [Sealed Exhibit.] 

1826 Id. at 7. 



314 



breakdowns and violations. We will likely be requiring additional action to address this 
concern." 1827 

In addition, for the first time, the ROE discussed HBUS' AML problems in the context of 
HBUS' CAMELS management rating, although the rating remained unchanged from the prior 
year. The ROE noted that HBUS was the subject of several ongoing investigations that could 
damage its reputation, and the OCC was "increasingly concerned with weaknesses in compliance 
(particularly BSA/AML) risk management," including "the quality of BSA/AML monitoring and 
compliance." The ROE stated that the ongoing AML examination "is revealing weaknesses that 
have impacted our overall assessment of the program and its management." 1828 

The ROE also discussed the AML problems in the section on HBUS' Consumer 
Compliance Rating and disclosed that it was lowering that rating as a result. The ROE stated: 

"[W] are lowering our assessment of the quality of compliance risk management from 
satisfactory to weak . . . The high level of BSA/AML/OFAC risk associated with HBUS' 
business activities is a significant factor in our assessment. ... In addition to the high 
level of risk presented by its business activities, HBUS has a high quantity of risk based 
upon significant indications that the bank is not in compliance with all laws and 
regulations. . . . Based upon our work to date, we have identified deficiencies relating to 
HBUS' transaction monitoring, analysis of customer due diligence information, 
adherence to the USA PATRIOT Act; and filing of Suspicious Activity Reports (SARs). 
. . . We are changing our assessments of both HBUS' BSA/AML program and its overall 
compliance management program from satisfactory to weak. These changes are based 
upon our concerns regarding (1) the lack of effective compliance oversight provided by 
the head of HNAH/HBUS' compliance department, (2) the ineffective results to date of 
HBUS' project to implement a new model for its compliance structure and process, and 
(3) the deficiencies that we have identified to date during our expanded examination of 
HSBC's Global Banknotes business and the concerns raised by multiple external 
parties." 1829 

The OCC lowered HBUS' Consumer Compliance Rating even though it did not identify any 
problems related to bank compliance with consumer protection or civil rights laws. The OCC's 
actions contravened the interagency agreement on how to calculate this rating, which required a 
focus on consumer protection and civil rights laws, not AML requirements. 

Although its Consumer Compliance Rating was lowered, the bank's safety and soundness 
ratings remained unchanged. Neither the CAMELS management component rating nor the 
overall composite rating were lowered. These unchanged ratings meant that the bank would also 
not incur any added federal deposit insurance fees, despite its elevated AML risk. 

On April 15, 2010, the OCC's Washington Supervision Review Committee approved an 
Order of Investigation "concerning potential violations of law and unsafe and unsound conduct 



1827 Id. at transmittal letter. 

1828 Id at 3-4. 



1829 Id at 6. 
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in connection with the BSA/AML policies and practices of HSBC Bank USA, N A." 1830 The 
issuance of the Order was based on the preliminary findings of the expanded AML examination, 
which by that point had identified evidence of a backlog of alerts that had not been processed for 
suspicious activity reporting; failure to adequately monitor foreign affiliates; and failure to 
adequately monitor wire transfer transactions for customers in countries designated "standard" or 
"medium" risk by the bank. 

On September 13, 2010, the OCC issued the 31-page Supervisory Letter described 

1 83 1 

earlier, outlining a long list of significant AML problems at HBUS. The Supervisory Letter 
also cited the bank for a violation of the Bank Secrecy Act statute for failing to maintain an 
effective AML program. The letter informed HBUS that "the bank's compliance program and 
its implementation are ineffective, and accompanied by aggravating factors, such as highly 
suspicious activity creating a significant potential for unreported money laundering or terrorist 
financing." In addition, the letter stated: 

"Since the OCC terminated the Formal Agreement in February 2006, the bank has had a 
high number of MRAs and the OCC continues to identify serious deficiencies in the 
bank's BSA/AML compliance program. Over the past two years, the examination scopes 
have included many of same areas that are of concern at this examination. The OCC has 
issued twelve MRAs during this period, many of which address similar issues compared 
to its current concerns, including the adequacy of compliance leadership, alert 
management, and monitoring systems. 1833 

In October 2010, six years after becoming HBUS' primary federal regulator, the OCC 
issued its own formal enforcement action, a Cease and Desist Order requiring corrective action 
on many of the same problems identified by the Federal Reserve seven years earlier in 2003. 1834 

Federal Reserve Ratings. The OCC was not the only federal banking regulator that 
examined HBUS. Because HBUS had federally insured deposits, the FDIC acted as a secondary 
regulator. In addition, the Federal Reserve was responsible for regulating HBUS' holding 
company, HSBC North America Holdings (HNAH) as well as an Edge Act Corporation that 
HBUS owned in Florida. The Subcommittee did not attempt to review the oversight exercised 
by these two other regulators. The Subcommittee did note, however, that as of 2009, the Federal 
Reserve Bank of Chicago maintained a lower rating for HNAH's risk management, in part 
because of the AML problems at HBUS. 

The 2009 Federal Reserve report stated: "[T]he primary driver for the overall rating is 
the unsatisfactory BSA/AML program. BSA/AML risk is currently the highest inherent Legal 
and Compliance risk for HNAH." 1835 The Federal Reserve report stated that the bank's 



1S3U 04/9/2010 OCC Memorandum, "Order of Investigation - HSBC Bank USA, N.A., New York, NY", OCC-PSI- 
00899481. 

1831 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering ("BSA/AML") 
Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21," OCC-PSI-00864335. [Sealed Exhibit.] 

1832 Id. at OCC-PSI-00864336. 

1833 Id. at OCC-PSI-00864335. 

1834 See In re HSBC Bank USA N.A. , Case No. AA-EC-10-98, Department of the Treasury Comptroller of the 
Currency, Consent Order (10/4/2012), OCC-PSI-00904698. 

1835 See Federal Reserve Bank of Chicago report as of December 31, 2009, BOG-SR-001368, at 1. [Sealed Exhibit.] 
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compliance program had focused "inward on alignment with Group, cost reduction, and 
centralization without sufficient focus on implementing and maintaining good risk identification, 
control, measurement, and management processes." 1836 It also noted that "HNAH's strategic 
plan was to focus on customers and business lines with international connections, which present 
higher levels of BSA/AML and OFAC risks." According to the Federal Reserve: 

"[T]he significant weaknesses and issues identified by regulators on the BSA/AML 
program underscores senior compliance management' s inability to self-identify 
compliance risks and to note significant control deficiencies in a timely fashion. While 
the inabilities of senior compliance management [are] a primary driver for the 

1837 

downgrade of board and senior management oversight rating, the lack of a sound risk 
management function that adequately includes compliance risk is also a contributor." 

In October 2010, on the same day and in coordination with the OCC, the Federal Reserve 
issued its own formal enforcement action with respect to HNAH, requiring it to strengthen its 
"firmwide compliance risk management program," including with respect to AML compliance, 
and ensure that HBUS complied with the OCC order. 1839 

(2) Six Years of AML Deficiencies 

An OCC presentation providing an "AML Retrospective (2001-2011)" includes a chart 
showing that, from January 2005 to March 2010, the OCC issued 85 AML-related Matters 
Requiring Attention to the HBUS Board of Directors, which was a third more AML-related 
MRAs than the next closest major bank. 1840 An experienced OCC AML examiner told the 
Subcommittee: "I thought I saw it all with Riggs, but HSBC was the worst situation I'd ever 



The following chart summarizes many of the OCC-issued MRAs related to AML 
problems at HBUS. It shows that the examinations repeatedly revealed critical AML problems 
across HBUS business units, many of which offered high risk products, had high risk clients, or 
engaged in high risk activities vulnerable to money laundering and terrorist financing. Twenty- 
one of the examinations identified problems with the bank's AML monitoring systems, including 
in its wire transfer, pouch, foreign corresponding banking, international and domestic private 
banking, retail banking, credit cards, Embassy banking, Banknotes, and Payment and Cash 



This targeted examination did not result in a downgrade at the overall holding company level. 

1838 Id. at 5. 

1839 See In Re HSBC North America Holdings, Inc. , Case No. 10-202-B-HC , before the Board of Governors of the 
Federal Reserve System, Cease and Desist Order Issued Upon Consent Pursuant to the Federal Deposit Insurance 
Act as Amended (10/4/2012). 

1840 See undated presentation, "BSA Officer Roundtable: Bank Secrecy Act Policy and Legal Update," by John 
Wagner, OCC Director of BSA/AML Compliance, and James Vivenzio, OCC Senior Attorney for BSA/AML, chart 
entitled, "BSA/AML MRA: Large Banks: Full Information System Extract (LBIS)," OCC-PSI-01768523. See also 
Subcommittee interviews of Elsa de la Garza, Joseph Boss, and James Vivenzio (confirming HBUS had an 
unusually high number of MRAs compared to other banks); 9/13/2010 OCC Supervisory Letter HSBC-2010-22, " 
Bank Secrecy Act/ Anti-Money Laundering ('BSA/AML') Examination - Program Violation (12 U.S.C. § 1818(s); 
12 C.F.R. § 21.21)," OCC-PSI-00864335 at 9 ("Since the OCC terminated the Formal Agreement in February 2006, 
the bank has had a high number of MRAs"). [Sealed Exhibit.] 

1841 Subcommittee interview of Joseph Boss (1/30/2012). 
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Management operations. Inadequate customer due diligence and client information were 
similarly identified in multiple business lines and services. Noncompliance with bank policy 
was another common problem. Inadequate staffing and AML training were also repeatedly 
identified, as were weaknesses in internal reviews of AML compliance. Later on, weaknesses in 
AML leadership at the bank were also identified. When AML examiners were allowed to 
undertake a broader analysis of the AML program, they identified additional fundamental 
problems involving backlogs, inappropriate assessment of country and client risk, favored 
treatment of HSBC affiliates, and massive gaps in monitoring. 

For more than six years, from July 2004 until April 2010, despite compiling a litany of 
AML deficiencies, the OCC never cited HBUS for a violation of law, never took a formal or 
informal enforcement action, and turned down recommendations to issue Cease and Desist 
Orders targeting particularly egregious AML problems, even though the same problems surfaced 
again and again. The OCC's failure to compel HBUS to remedy the AML deficiencies 
repeatedly identified by its examiners over a six-year period indicates that systemic weaknesses 
in the OCC's AML oversight model require correction. 
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C. OCC Systemic Failures 

The OCC's failure for six years to take action to force correction of fundamental 
problems in HBUS' AML program allowed those problems to fester and worsen. Five key 
weaknesses in OCC oversight contributed to its those failures: (1) treating AML deficiencies as 
a consumer compliance issue instead of a management issue; (2) unnecessarily restricting 
citations of AML program violations; (3) failing to match narrowly focused AML examinations 
with broader reviews; (4) failing to make better use of formal and informal enforcement actions 
in the face of continuing AML problems; and (5) issuing Supervisory Letters that sometimes did 
not accurately convey the AML problems identified in examinations. AML problems that 
surfaced even after bank commitments to cure identified problems was also a common thread. 

(1) Treating AML Deficiencies As A Consumer Compliance Issue 

The OCC is the only federal bank regulator that does not address AML problems within 
the context of a bank's safety and soundness considerations and ratings, instead treating them as 
a matter of consumer compliance. This approach raises at least three concerns. First, combining 
AML and consumer compliance concerns undermines and confuses the consumer compliance 
rating. AML compliance issues are unrelated to consumer protection and civil rights laws and 
should have no bearing or impact on a bank's consumer compliance rating. Inserting AML 
considerations into the rating process also directly contravenes the Uniform Interagency 
Consumer Compliance Rating System specifying how that rating is supposed to be calculated 
and what it is supposed to signify. 1842 In the case of HBUS, the OCC ended up lowering its 
consumer compliance rating in 2010, without citing any evidence that the bank was failing to 
comply with consumer protection or civil rights requirements. 

Secondly, failing to maintain an effective AML program is more properly viewed as a 
management issue that should contribute to a bank's CAMELS management rating and, 
ultimately, the bank's composite rating. Federal banking agencies have agreed, for example, that 
a bank with a "2" CAMELS management rating means that "significant risks and problems are 
effectively identified, measured, monitored, and controlled" by bank management. 1843 In 
contrast, a bank with a "3" management rating signifies "management and board performance 
that needs improvement or risk management practices that are less than satisfactory given the 
nature of the institution's fiduciary activities." A 3 rating also means that the "capabilities of 
management or the board of directors may be insufficient for the size, complexity, and risk 
profile of the institution's fiduciary activities. Problems and significant risks may be 
inadequately identified, measured, monitored, or controlled." 1844 These descriptions of the 
significance of the CAMELS management rating are directly applicable to management efforts 
to ensure an effective AML program. 



See "Comptroller's Handbook — Consumer Compliance Examination," Appendix A, "Uniform Interagency 
Consumer Compliance Rating System," http://www.occ.gov/publications/publications-by-type/comptrollers- 
handbook/_paginated/overview/default.htm?startat=over00013.htm. Compare with FDIC, 
http://www.fdic.gov/regulations/laws/rules/5000-1700.html; Federal Reserve Bank, 

http://www.fedpartnership.gov/bank-life-cycle/topic-index/bank-rating-system.cfm; Consumer Financial Protection 
Bureau, http://www.consumerfinance.gov/guidance/supervision/manual/examinations/. 

1843 See Uniform Interagency Management Component Ratings: http://www.occ.gov/publications/publications-by- 
type/comptrollers-handbook/_paginated/banksupervisionprocess/default.htm?startat=bank00108.htm 
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Interagency agreement on the significance of a bank's overall composite rating is also 
compatible with this approach. Federal banking agencies have agreed that a composite rating of 
"2" means that a bank is "in substantial compliance with laws and regulations," that "overall risk 
management practices are satisfactory," and "there are no material supervisory concerns and, as 
a result, the supervisory response is informal and limited." 1845 A "3" composite rating means 
banks: 

"exhibit some degree of supervisory concern in one or more of the component areas. 
These financial institutions exhibit a combination of weaknesses that may range from 
moderate to severe; however, the magnitude of the deficiencies generally will not cause a 
component to be rated more severely than 4. Management may lack the ability or 
willingness to effectively address weaknesses within appropriate time frames. Financial 
institutions in this group generally are less capable of withstanding business fluctuations 
and are more vulnerable to outside influences than those institutions rated a composite 1 
or 2. Additionally, these financial institutions may be in significant noncompliance with 
laws and regulations. Risk management practices may be less than satisfactory relative to 
the institution's size, complexity, and risk profile. These financial institutions require 
more than normal supervision, which may include formal or informal enforcement 
actions." 1846 

These categories fit seamlessly with management issues related to AML concerns. 

Currently, federal banking agencies other than the OCC routinely consider AML 
deficiencies as one factor in assigning a bank's management rating and may downgrade that 
rating if management fails to maintain an adequate AML program. The management component 
rating is a reflection of management's ability to adequately identify, measure, monitor, and 
control problems and significant risks. The failure to maintain an adequate AML program 
exposes a bank to significant reputational risks, potentially large civil money penalties, and 
criminal prosecution. When such factors are present, it makes sense for a bank regulator to 
weigh them when assigning the bank's management rating. If the management component is 
downgraded, it may also in certain circumstances lower the overall composite rating, with 
potentially severe impacts on the financial institution's reputation, risk profile, and insurance 
assessment fees. 

In the case of HBUS, after documenting widespread and serious AML deficiencies, citing 
the bank for two violations of law, noting the potential for large civil money penalties, and 
criticizing both bank management and the board of directors for failing to provide an adequate 
AML program, the OCC downgraded the bank's consumer compliance rating, but not its 
CAMELS management rating. The bank's composite rating was also unaffected. The result is 



1845 See Uniform Financial Institutions Rating System, discussed in 9/2007 "Comptroller's Handbook — Bank 
Supervision Process," http://www.occ.gov/publications/publications-by-type/comptrollers- 
handbook/_pdf/banksupervisionprocess.pdf, at 55. 

1846 Id. 
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that HBUS executives and directors escaped any CAMELS consequences for their poor AML 
management. 1847 

A third, related problem is that because consumer compliance is a specialty examination 
area with its own, separate rating system, a lower consumer compliance rating will rarely impact 
a bank's composite rating. The OCC Reports of Examination make it clear that the consumer 
compliance rating is not a contributing factor that has a routine impact on a bank's composite 
rating. HBUS was also aware that its composite rating was generally insulated from the 
problems with its AML performance, as indicated in a February 2010 email from the HNAH 
compliance head Janet Burak to top HNAH and HBUS executives Brendan McDonagh and Irene 
Dorner. At a time when HBUS was in the midst of an intensifying AML examination which 
would ultimately lead to a Cease and Desist Order, Ms. Burak wrote: 

"I met with the OCC today. . . . Sally [Belshaw, the OCC Examiner-in-Charge] 
also indicated that they are considering downgrading their assessment of 
Compliance Risk Management . . . although [Sally] indicated that if they make 
that decision it will not impact the Bank's composite CAMELS rating . . . and 
would not likely impact the Management rating component." 1848 

This email demonstrates that bank officials were aware of how the process for rating 
AML performance had little real impact on the safety and soundness ratings that carried 
important consequences. It suggests that if AML problems had CAMELS consequences 
on a routine basis, they might have greater significance for management. 

The OCC Reports of Examination on HBUS occasionally discuss the bank's 
AML problems in the part of the report analyzing its management rating or composite 
rating, perhaps because the issue is relevant to those discussions. But the OCC confined 
the impact of the bank's AML problems to lowering HBUS' consumer compliance rating 
and not its CAMELS management or composite ratings which remained unaffected. 

The OCC's peculiar treatment of AML concerns as a consumer compliance issue has 
multiple negative consequences. National banks that fail to maintain adequate AML programs 
may end up receiving more favorable safety and soundness ratings than they deserve, because 
the consumer compliance ratings have almost no impact on their management or composite 
ratings. They may also receive lower consumer compliance ratings than they deserve for the 
opposite reason. Another consequence is that the bank's deposit insurance assessments remain at 
a lower level than they should, as a result of safety and soundness ratings that do not fully reflect 
their AML risks. Treating AML concerns as a management issue would mitigate those negative 
consequences and create a stronger incentive for national banks to focus on their AML 
obligations. To strengthen its AML oversight, the OCC should bring its practice into alignment 
with all other federal bank regulators, remove AML considerations from its consumer 
compliance ratings, and consider AML issues in the context of the CAMELS management 
component. 



A related problem is that because the Federal Reserve downgraded HBUS' holding company due to the AML 
problems at HBUS, HNAH executives ended up incurring lower ratings for HBUS' AML management failures, but 
HBUS executives did not. 

1848 2/24/2010 1 email from HNAH Janet Burak to HBUS Brendan McDonagh and Irene Dorner, HSBC OCC 
3405315. 
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(2) Restricting Citations of AML Program Violations 

A second peculiarity in OCC AML oversight is its failure to cite violations of law in its 
Supervisory Letters and annual Reports of Examination when a bank fails to comply with one of 
the four statutorily mandated components of an effective AML program — described earlier as 
internal controls, an AML compliance officer, AML training, and independent testing - even 
though each of the four program components has its own statutory basis. 1849 Instead, the OCC 
has adopted a practice of not citing violations of the individual AML program components, 
instead treating any such deficiency as a Matter Requiring Attention (MRA) by the bank. 1850 

Although MRAs require corrective action by bank management, they are separate and 
distinct from violations of law. OCC guidance provides that MRAs should address bank 
practices that "deviate from sound fundamental principles and are likely to result in financial 

1 85 1 

deterioration if not addressed," or that "result in substantive noncompliance with laws." 
MRAs are intended to target weak policies and practices before they result in violations, and 
provide an interim step before finding a bank in violation of the law. At the same time, because 
MRAs signify matters that require the "attention" of management, they do not carry the same 
legal weight and urgency as violations of law. While they play an important role in AML 
oversight by focusing bank officials on emerging AML problems, if they take the place of 
statutory violations, MRAs can end up misleading a bank about the seriousness of an AML 
deficiency, delay remedial action, and allow an AML problem to fester. Citing a bank for 
noncompliance with the law, on the other hand, carries more severe consequences if left 
unaddressed. It also sends a much stronger message to bank management about the need for 
prompt corrective action, and lends more weight to any subsequent formal or informal 
enforcement action in the event the problem continues. 

The OCC's practice of not citing a bank for violating the individual statutory 
requirements for an effective AML program meant that OCC examiners were effectively limited 
to using only MRAs to compel reform of an identified problem. In the case of HBUS, OCC 
AML examiners repeatedly identified instances in which HBUS failed to comply with one or 
more of the four pillar requirements of an effective AML program. HBUS often responded by 
addressing some of the narrow problems identified, but not the broader underlying programmatic 
deficiencies, perhaps because the problems were identified in the more neutral language of an 
MRA rather than as a violation of law. 



184y See 31 U.S.C. § 5318(h)(l)(A)-(D). 

1850 One OCC senior legal counsel specializing in AML matters told the Subcommittee that the OCC "will not cite 
pillar violations" and instead lists them as MRAs which are not enforceable in court. He said that the OCC uses the 
same approach when reporting AML examination findings to FinCEN, describing the OCC's reporting as "cleaner" 
and not "cluttered with component violations" like the other agencies. Subcommittee interview of James Vivenzio 
(3/15/2012). As indicated earlier, annual reports compiled by FinCEN show that, for the five year period from 2007 
through 201 1, OCC examiners cited only 16 pillar violations in more than 6,600 AML examinations. That total 
represents more than 10 times fewer violations than the nearest federal bank regulator, despite the OCC's having 
conducted nearly 1,800 more AML examinations. See 2007-201 1 Federal Banking Agency Bank Secrecy Act 
Compliance Examination, "Consolidated Quarterly Reports," PSI-FinCEN-04-0063-296. [Sealed Exhibit.] 

1851 OCC's "Examiner's Guide to Problem Bank Identification, Rehabilitation, and Resolution", page 24. 
http://www.occ.gov/publications/publications-by-type/other-publications-reports/prbbnkgd.pdf 
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AML Compliance Officer. In one case, in 2009, the OCC determined that the HBUS 
AML head was not qualified for the position, a rare personnel decision prompted by the bank's 
deteriorating AML program. Having a qualified AML compliance officer is one of the four 
critical requirements of an effective AML program and is mandated by statute and regulation. 1852 
An OCC AML examiner wrote the following about the problem: 

"Over the past three years, HBUS has had three BSA/AML Officers. Ms. Lesley 
Midzain is the current Board designated BSA/AML Officer for HBUS. She has held this 
position since April 2008. She has limited BSA/AML knowledge and industry 
experience and is not considered qualified for the position of BSA/AML Officer. This 
finding is based on numerous interviews by both OCC HSBC resident staff and other 
OCC large bank staff. She has not enhanced her knowledge of U.S. law related to 
BSA/AML through formal training, other than internal web based training. It should be 
noted that even with limited knowledge of U.S. law and regulation, Ms. Midzain has 
assumed responsibility for both BSA/AML and Compliance. 

We communicated to the HBUS President and to Ms. Janet Burak, Chief Compliance 
Risk Officer that Ms. Midzain does not possess the technical knowledge or industry 
experience to continue as the BSA/AML Officer. Ms. Midzin's knowledge and 
experience with BSA/AML risk is not commensurate to that of other BSA/AML 
positions held at other large national banks." 1853 

The FFIEC AML Examination Manual states that "the appointment of a BSA compliance 
officer is not sufficient to meet the regulatory requirement if that person does not have the 
expertise, authority, or time to satisfactorily complete the job." 1854 The OCC viewed HBUS as a 
large complex financial institution with numerous high risk aspects that required a fully qualified 
AML expert to administer the bank's AML program. To express the urgent need for the bank to 
hire a qualified AML director, the OCC could have cited HBUS for violating the law, but chose 
instead to issue a Supervisory Letter listing the issue as an MRA. 1855 The bank responded by 
keeping the targeted official as its head of compliance, hiring a new AML director, and requiring 
that new AML director to report to the compliance head with no AML expertise. The new AML 
director left after about nine months. 

AML Internal Controls over Pouch Services. In another instance, in January 2007, an 
OCC examination identified serious AML problems with HBUS' pouch services, which 
appeared to be operating with virtually no compliance with AML standards. Pouch services 
involve clearing U.S. dollar monetary instruments such as travelers cheques, bank cheques, and 
money orders. The AML problems included a lack of monitoring for suspicious activity, 
insufficient policies and procedures, and a lack of AML controls. As a result, the OCC 



1532 See 31 U.S.C. § 5318(h)(1)(B) and 12 C.F.R. Section 21.21(c)(3). 

1853 5/15/2009 OCC Memorandum, "Compliance Management Exam", OCC-PSI-014381 15. 

1854 4/29/2012 FFIEC BSA/AML Examination Manual, "BSA/AML Compliance Program - Overview - BSA 
Compliance officer," at 36, http://www.ffiec.gov/bsa_aml_infobase/documents/BSA_AML_Man_2010.pdf. 

1855 7/7/2009 OCC Supervisory Letter 2009-01 "Compliance Management Examination," OCC-PSI-00107631. 

1856 6/14/2006 OCC Supervisory Letter HSBC-2006-16, "Compliance Review Unit Examination," OCC-PSI- 
00000341 (deeming problems with the independent testing pillar component inadequate to justify citing a legal 
violation]). [Sealed Exhibit.] 
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broadened its examination to pouch services at other HBUS business units, including the PCM, 
International Private Banking, Domestic Private Banking and retail banking departments. That 
examination uncovered additional significant AML deficiencies that had been identified in 
examinations of other business lines, involving pillar program components such as lack of AML 
internal controls, training, and independent testing, with systemic implications. The 
examination concluded with respect to HBUS pouch services: 

"The results of this examination combined with the history of past examinations (i.e. 
significant number of MRAs) are an indication that program goals and objectives have 
not been met. The board needs to establish a program with defined elements for policies 
and procedures, systems and controls, training and independent audit to ensure 
unwarranted risk is being identified, monitored and mitigated to an acceptable level." 1858 

The OCC examiners recommended that a formal enforcement action be brought against 
the bank to compel immediate correction of the problems in pouch services. However, after 
researching OCC standards for bringing enforcement actions, the examiners determined that, to 
issue a Cease and Desist Order, the agency was required, in part, to cite a violation of law. 1859 



1857 4/10/2007 OCC Memorandum "BSA/AML Examination - HSBC, USA, NA - Pouch Activities", OCC-PSI- 
00899202 at 202 and 204 (reviewing pouch activities at the International Private Bank, Domestic Private bank, retail 
banking, and Payments and Cash Management business units). 

1858 Id. at 9. 

1859 6/14/07 OCC Memorandum from Joseph Boss to Anthony Dilorenzo, "Pouch Exam," OCC-PSI-0 1298625; 
7/3/07 OCC memorandum from Elsa de la Garza to Anthony Dilorenzo, "BSA/AML Examination - HSBC, USA, 
NA - Pouch Activities," OCC-PSI-00877731. See also OCC Policies and Procedures Manual 5310-3 (Rev). The 
June 14, 2007 memorandum described the OCC's enforcement standards as follows: 

"There are two types of enforcement actions prescribed by the OCC. They are 'informal actions' and 'formal 
actions.' PPM 5310-3 (Rev.) describes the criteria for considering whether or not an enforcement action should be 
taken against a financial institution. Generally, the nature, extent, and severity of the bank's problems will dictate 
the necessity for an action. The nature, extent and severity of a bank's problems can range from identified 
weaknesses that arc considered narrow in scope and correctible to significant and substantial problems and 
weaknesses that jeopardize the safe and sound operation of the bank. In all instances a number of other factors must 
be taken into consideration before the imposition of an action. Some of those factors are: 

• Overall rating of the financial institution. 

• Financial condition of the financial institution. 

• Past cooperativeness of management. 

• Management's ability and willingness to correct identified problems in appropriate timeframes .... 

The examiner also identified the standards used to assess whether or not a violation may be cited: 

"As stated earlier, in order for the OCC to take any form of enforcement action, certain criteria must be considered. 
This also applies in considering citing a violation under 12 CFR 21.21. For citing a violation of 12 CFR 21.21 the 
following must be evident: 

• The bank lacks a BSA compliance program that covers one or more of the required program elements 
(internal controls, training, audit, responsible personnel); 

• Fails to implement a written BSA compliance program; 

• Exhibits significant BSA compliance program deficiencies coupled with aggravating factors such as 
evidence of widespread, blatant structuring or money laundering, insider complicity, repeat failures to 
file currency transaction reports or suspicious activity reports, or other substantial BSA violations; or 

• Fails to respond to supervisory warnings concerning significant BSA compliance program 
deficiencies." 
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Although OCC written guidance states that one criteria for a formal enforcement action is 
whether: "[t]he bank lacks a BSA compliance program that covers one or more of the required 
program elements (internal controls, training, audit, responsible personnel)," OCC personnel told 
the Subcommittee that the OCC had interpreted this language to allow a violation of law to be 
cited only for a complete program failure, and not when a single pillar or even multiple pillars of 
an AML program are inadequate. The examiners determined that they could not conclude 
that HBUS' entire AML program was ineffective at that time. Accordingly, despite the 
significant AML deficiencies found in connection with HBUS pouch services, the OCC 
examiners concluded they could not cite a violation of law and so withdrew their request for a 
formal enforcement action. Instead the OCC included a single MRA on pouch services in a 
Report of Examination sent to the bank in July 2007, 1861 and five MRAs in a Supervisory Letter 
sent to the bank two months later. 1862 



The OCC's decision not to cite violations of law or take formal or informal enforcement 
action to correct severe AML deficiencies that contravene key AML statutory requirements 
makes no sense. An effective AML oversight effort must be able to act in just such 
circumstances, and premise an enforcement action on any statutory requirement, including that 
financial institutions have AML internal controls, an AML compliance officer, AML training, 
and independent testing, without having to find that virtually all four statutory requirements are 
being violated at the same time. 

Federal bank regulators other than the OCC routinely cite violations of law when a bank 
fails to comply with one or more of the pillar components of an AML program. 1863 By declining 
to do the same, the OCC is diluting the importance of the four components; it is essentially 
sending a message that a bank can lack one or more of the components as long as its entire AML 
program is not compromised. In addition, by restricting itself to MRAs rather than citations of 
legal violations, the OCC is unnecessarily diluting its ability to send a strong message that a bank 
needs to promptly correct a program element, such as an inadequate AML compliance officer or 
a set of missing AML controls. By limiting its examiners to using MRAs instead of citing 
statutory violations, the OCC is, in effect, allowing particular problems to fester, as happened in 
the HBUS case. In addition, by restricting citation of individualized program violations, the 
OCC is impairing the ability of examiners to pursue formal enforcement actions, which is 
exactly what happened in the case of the HBUS pouch activities. 

Finally, failing to identify violations of laws and regulations may mislead or confuse 
bank management. Violations are addressed prominently in the Reports of Examination and 
Supervisory Letters. A bank's directors and managers should be aware of apparent violations of 



Subcommittee interviews of OCC James Vivenzio (3/15/2012), Joseph Boss (1/30/2012), Elsa de la Garza 
(1/9/2012). 

1861 7/24/2007 OCC Report of Examination of HBUS, for the examination cycle ending March 31, 2007, OCC-PSI- 
00304077. [Sealed Exhibit.] 

1862 9/13/2007 OCC Supervisory Letter HSBC-2007-01, "Pouch Services and Middle Market," OCC-PSI-00000391. 
[Sealed Exhibit.] One examiner informed the Subcommittee that, even though they determined the AML 
deficiencies in HBUS' pouch services did not meet the OCC's enforcement guidelines, he still felt that an 
enforcement action should have been initiated. Subcommittee interview of Joseph Boss, (1/12 - 13/2012). 

1863 See 2007-201 1 Federal Banking Agency Bank Secrecy Act Compliance Examination, "Consolidated Quarterly 
Reports," PSI-FinCEN-04-0063-296. [Sealed Exhibit.] 
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law, given their potentially punitive nature and the bank's responsibility to initiate appropriate 
corrective action. Violations that are instead reduced to MRAs may mislead a bank by omitting 
references to specific laws or regulations; downplay the importance of the targeted activity; and 
insulate the bank's ratings from downgrades that would spur corrective action. Examiners 
evaluate bank ratings, including the CAMELS management rating and its consumer compliance 
rating on a number of factors, including management's compliance with laws and regulations, its 
responsiveness to previously reported violations of law, MRAs, and audit findings. Removing 
violations from that equation enables a bank to obtain more favorable ratings than it may 
deserve. To strengthen its AML oversight, the OCC should bring its practice into alignment with 
all other federal bank regulators and allow examiners to cite violations of law when a bank fails 
to comply with one or more of the four statutorily mandated components of an AML program. 

(3) Using Narrowly Focused Exams 

A third AML oversight practice of concern involves the use of narrowly focused AML 
examinations that don't also include an examination of a bank's overall AML program. At 
HBUS, the OCC designed an AML supervisory strategy to examine the institution over a three 
year cycle using targeted examinations. HBUS had 32 different business units with varying 
degrees of AML risk, all of which were to be examined. The plan called for business units with 
the highest AML risks to be examined first. According to the examiners, the mandate was to 
examine all 32 business units over a three-year cycle, taking 8 to 10 weeks to examine a business 
unit from start to finish, using Supervisory Letters to communicate examination results. 1864 
According to the plan, OCC examiners would not return to a previously examined area until it 
had examined all 32 business units, and the adequacy of management's corrective actions for any 
MRAs would be reviewed once the entire institution had been examined. 

The OCC had to depart from this plan given the significant AML risks uncovered at some 
business units. 1865 In addition, with only two full-time AML examiners dedicated to HBUS, and 
given the complexity, breadth, and volume of its high risk activities, the OCC had difficulty 
meeting the three- year objective but strived to achieve it. 1866 The result was a series of narrowly 
focused, targeted examinations. As each examination concluded, a Supervisory Letter was 
issued with MRAs or recommendations addressing the AML issues at each specific business 
unit. 

This examination approach, which failed to provide any mechanism for also taking a 
holistic view of the bank's AML program, raised at least three issues in the HBUS setting: it 
impeded understanding of fundamental problems with the bank' s AML program and allowed 
systemic problems to fester, it required duplicative efforts, and it made verification of corrective 
action more difficult. First, the narrow focus of the individual examinations at HBUS made it 
difficult for OCC examiners to understand the bank's AML program as a whole, to detect 
systemic problems, or make the case for correcting them. Instead, the OCC continued to review 



1SM Subcommittee interview of Joseph Boss (1/30/2012), and Elsa de la Garza (1/9/2012). 

1865 The OCC revisited, for example, the Global Banknotes unit in 2005, 2006, 2007, 2008, and 2009 and targeted 
exams of Embassy Banking in 2005, 2006 (three times), 2007, 2008, and 2009. 

1866 examiners told the Subcommittee that two additional full time AML examiners were needed to meet the 
three-year cycle at HBUS, but that staff dedication would have been disproportionate to AML examination staffing 
at other large national banks. While they were assisted at times by other examiners, the vast bulk of the AML 
examinations at HBUS were carried out by two OCC AML examiners. 
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individual business units on a serial basis, addressing the AML problems uncovered in each 
examination. As a result, the OCC requested and HBUS provided narrow corrective actions, 
allowing more systemic problems to go unaddressed for years. In addition, it required OCC 
examiners to address similar AML problems in multiple business units on a repetitive basis. 

HSBC Affiliate Issues Missed. The limitations of this approach can be seen in the way 
in which targeted reviews of key bank areas, such as correspondent banking and the Payments 
and Cash Management (PCM) department, missed major AML deficiencies involving HSBC 
affiliates. It was only in 2010, when OCC AML examiners were allowed to take a broad -based 
review of HBUS' AML program, that the examiners focused on the fact that HSBC affiliates 
played a large role in HBUS' correspondent banking and PCM businesses, but were not 
subjected to the same AML controls as other clients. The OCC examiners discovered, for 
example, that HBUS did not conduct any due diligence review of HSBC affiliates or attempt to 
evaluate their AML risks. 1867 The OCC examiners also discovered that HBUS had stopped 
monitoring all banknotes business with HBSC affiliates for a three-year period, from mid-2006 
to mid-2009, even though those transactions involved billions of dollars of cash and high risk 
countries like Mexico. 1868 The OCC also learned that HBUS failed to conduct routine account 
monitoring for dozens of affiliates located in lower risk countries. Still another problem was that 
OCC examiners determined that HBUS was using an inappropriate process to assess country 
risk, and was assigning low risk ratings to countries such as Mexico, that should have been 
designated high risk. Narrowly focused exams, without more, simply didn't identify affiliates as 
an important AML concern that cut across multiple business lines. 

AML Staffing Issues Fragmented. A second example involves a series of three AML 
examinations conducted by the OCC in early 2009, disclosing insufficient staffing to conduct 
AML monitoring activities in three critical business units, OFAC compliance, Correspondent 
Banking and the Payments and Cash Management (PCM) department. OCC examiners looked at 
each business unit individually and the Examiner-in-Charge issued three different Supervisory 
Letters that questioned the bank' s staffing levels and resource commitment in each unit for AML 
purposes. 1 By conducting three different examinations with no overarching analysis of AML 
staffing issues across the bank, the OCC failed to identify inadequate AML staffing as a systemic 
issue and deal with it in an efficient and effective basis. Instead, each Supervisory Letters 
focused on a single business line or functional area under review, with no cross references to the 
other areas having the same problem, at the same time. The recommendations contained in two 
of the Supervisory Letters, issued in March 2009, contained nearly identical wording, including 



See 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering 
('BSA/AML') Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335. 
[Sealed Exhibit.] 

1868 In the summer of 2009, OCC examiners learned for the first time that affiliates' banknotes activity was not 
monitored when examining banknotes activity involving an HSBC affiliate in Mexico. The key law enforcement 
meeting took place the next month, and the banknotes examination was then expanded to look at other AML issues. 
The banknotes monitoring problem was included in the Supervisory Letter issued a year later identifying a host of 
AML problems at HBUS. See 8/12/2009 OCC memorandum, "Banknotes Issues," OCC-PSI-00917881-882. 

1869 1/20/2009 OCC Supervisory Letter HSBC-2008-41, "Office of Foreign Asset Control Examination," OCC-PSI- 
00000434; 3/3/2009 OCC Supervisory Letter HSBC-2008-34, "Correspondent Banking BSA/AML Examination," 
OCC-PSI-00107618; 3/18/2009 OCC Supervisory Letter HSBC-2008-40 "Payment and Cash Management 
BSA/AML Examination," OCC-PSI-00 107624. [Sealed Exhibits.] 
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the same misspelled word. As a result, the staffing issues were addressed in a fragmented 
manner in three different recommendations rather than in a single MRA focusing on the broader 
problem. 

It was not until 2010, after the OCC directed its AML examiners in September 2009, to 
undertake a more holistic analysis of HBUS' AML program that staffing was examined in a 
broader way. On March 3, 2010, an OCC Supervisory Letter discussing the discovery of an 
HBUS backlog of over 17,000 unreviewed alerts noted that staffing concerns had been raised 

1 87 1 

three times in 2009, and identified it as a Matter Requiring Attention by the HBUS Board: 

"In the past, HSBC has had other backlogs, and we have expressed concerns over the 
course of our supervision about the levels of staffing and the qualifications of personnel 
assigned to complete reviews 

"In three Supervisory Letters last year, we expressed concerns about the levels of staffing 
dedicated to BSA/AML/OFAC compliance. These letters include the supervisory letter 
issued on January 20, 2009 at the conclusion of our OFAC examination, the supervisory 
letter issued on March 3, 2009 at the conclusion of the correspondent banking 
examination, and the supervisory letter issued on March 18, 2009 at the conclusion of the 
Payment and Cash Management examination." 1872 

Even then, however, the MRA on staffing was narrowly targeted: "Management must ensure 
that a sufficient number of qualified professionals are engaged to address the 2,488 alerts within 
the High Risk Monitoring Unit that were generated six or more months ago." Six months later, 
when the OCC concluded its broad-based examination of the HBUS AML program as a whole 
and issued a 31-page Supervisory Letter analyzing key problems, inadequate and unqualified 

1 87^ 

AML staffing was finally presented as a systemic problem across the bank. 

We Didn't Know What We Had. One of the OCC AML examiners immersed in the 
HBUS AML examinations for years told the Subcommittee that, upon learning of various law 
enforcement concerns about HBUS in September 2009, "we'd been doing all of these targeted 

1 874 

examinations and we didn't know what we had." It apparently took that jolt from law 
enforcement for OCC senior personnel to authorize the OCC AML examiners to develop a 
broad-based plan to look at the HBUS AML program as a whole, tie various problems together, 
and identify the most important AML deficiencies requiring correction. While the narrowly 
focused AML reviews were important to examine particular business units and identify specific 
issues within those offices, such examinations were incomplete and ineffective without a broad- 



18/u Compare 3/3/2009 OCC Supervisory Letter HSBC-2008-34, "Correspondent Banking BSA/AML Examination," 
OCC-PSI-00107618, at 619, with 3/18/2009 OCC Supervisory Letter HSBC-2008-40 "Payment and Cash 
Management BSA/AML Examination," OCC-PSI-00 107624, at 625. [Sealed Exhibits.] 

1871 7/7/2009 OCC Supervisory Letter HSBC-2010-03,"Backlog of Monitoring Alerts and Enhanced due Diligence 
Requests," OCC-PSI-00851542. [Sealed Exhibit.] 

1872 Id. 

1873 9/13/2010 OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering ('BSA/AML') 
Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335, at 337-338. 
[Sealed Exhibit.] 

1874 Subcommittee interview of Joseph Boss (1/30/2012). 
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based look at the bank's AML program as a whole to identify fundamental and cross-cutting 
issues critical to an effective AML effort. 

Still another problem created by the narrowly focused AML examinations was that they 
complicated efforts by OCC examiners to verify that corrective actions mandated in OCC MRAs 
were implemented before closing out an MRA. One issue was that examiners weren't supposed 
to return to re-examine the relevant business unit until much later, theoretically after completing 
a three-year review of all 32 HBUS units. In reality, the examiners had to ignore that aspect of 
the examination plan to verify that corrective action was taken. But even then, validation of the 
effectiveness of the remedies often required duplicative, repetitive efforts since many of the same 
problems had to be analyzed in multiple, individual business units. In addition, while HBUS and 
the OCC examiners were focused on AML problems in individual business lines and services, 
fundamental problems began to build up, including backlogs of unreviewed alerts, collections of 
unmonitored accounts, and overly favorable treatment of HSBC affiliates. 

The HBUS case history provides ample evidence that a stovepipe AML supervisory 
strategy that focuses solely on serial examinations of individual business lines or services 
without also examining a bank' s AML program as a whole creates a fragmented and inefficient 
view of a bank's AML program, wastes resources, encourages piecemeal corrective actions, fails 
to identify fundamental problems which are allowed to fester, and diminishes the usefulness of 
AML examination findings and corrective actions. To strengthen its AML oversight, the OCC 
should require its AML examiners to combine narrowly focused AML examinations with at least 
an annual examination of key elements of the bank's AML program as a whole. 

(4) Failing to Use Enforcement Actions 

The HBUS case history, like the Riggs Bank case history before it, betrays an ongoing 
reluctance by the OCC to use either informal or formal enforcement actions to compel AML 
improvements, even when a bank is cited for years for significant AML problems. 

The OCC identified serious AML deficiencies at HBUS for six years in a row, with the 
most AML-related MRAs of any bank it supervised, without considering or initiating a 
nonpublic, informal enforcement action. The reluctance to use informal enforcement actions 
appears to be a cultural preference rather than the result of any guidance or policy. As 
mentioned earlier, the OCC disclosed to the Subcommittee that it has taken only eight informal 

1 875 

enforcement actions against large banks for AML deficiencies since 2005. This approach is 
especially disconcerting in the HBUS case, since the bank expressed a willingness to work with 
the regulator to implement reforms. Informal remedies - which include requesting that the 
financial institution issue a safety and soundness plan, board resolution, commitment letter, or 
memorandum of understanding pledging to take specific correction actions by a certain date - 
offer useful tools that provide an interim step before a formal enforcement order that is public 
and carries legal penalties. These tools can be effective, but were not even considered by the 
OCC in the HBUS AML context. 

The HBUS case history also discloses a reluctance on the part of the OCC to use formal 
enforcement actions to correct AML deficiencies. Two examples involve AML examiners' who 



Subcommittee briefing by OCC legal counsel (7/13/2012). 
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twice recommended issuing a Cease and Desist Order against HBUS after finding severe AML 
deficiencies in the bank's pouch activities and Embassy Banking unit, but no enforcement action 
followed. In the case of the pouch activities, as discussed earlier, despite overwhelming 
evidence of substantial AML deficiencies, two OCC AML examiners agonized over whether 
they could make the case for an enforcement action and ultimately reversed their initial 
recommendation for a Cease and Desist Order. In the case of the Embassy Banking unit, as 
discussed earlier, again despite overwhelming evidence of the bank's failure to implement 
effective AML controls, an OCC examiner was told point blank by his superiors, with no further 
explanation, that no Cease and Desist Order would be issued. The failure of OCC officials to 
seriously consider a formal enforcement action in either of these two extreme cases demonstrates 
an enforcement problem. 

The OCC's AML enforcement guidance is clear in stating: "Even when the facts do not 
support citation of a BSA compliance program violation, the OCC may take a formal or informal 
enforcement action to ensure action." 1876 In addition, the OCC website explains: 

"The OCC may take enforcement actions for violations of laws, rules or regulations, final 
orders or conditions imposed in writing; unsafe or unsound practices; and for breach of 
fiduciary duty by institution-affiliated parties (IAP)." 1877 

These statements seem to provide the regulatory foundation and flexibility needed for the OCC 
to act quickly to address serious AML deficiencies, yet the HBUS case history demonstrates that 
the OCC remains hesitant to act, even in the face of severe AML problems and even after years 
of AML MRAs on record. To strengthen its AML oversight, the OCC should give strong 
direction to its examiners about the availability of enforcement options and create new 
mechanisms to require bank supervisory, enforcement, and legal personnel to review the need for 
formal or informal enforcement actions at banks with severe or longstanding AML deficiencies. 

(5) Issuing Weak Supervisory Letters 

A final issue involves the OCC's use of Supervisory Letters. The HBUS case history 
indicates these letters do not always accurately convey examination findings or the need for 
corrective action. 

Supervision Letters are the means by which an OCC Examiner-in-Charge officially 
informs a bank of examination findings, apparent violations of law, and MRAs warranting 
management attention. Violations and MRAs require corrective action by bank management; 
"recommendations" do not. In theory, OCC examination findings and changes to resolve AML 
deficiencies should be conveyed accurately in the related OCC Supervisory Letters sent to bank 
management; in reality, the HBUS case history showed that some Supervisory Letters muted 
criticisms or weakened recommended reforms. 

PCM Examination. One striking example of the discrepancies that arose between 
examination findings and Supervisory Letters involved the 2007 examination of HBUS' 
Payment and Cash Management (PCM) operations. PCM specialized in global cash flow 



"Process for Taking Administrative Enforcement Actions Against Banks Based on BSA Violations," OCC 
2005-45 Attachment Appendix A to OCC 2004-50. OCC-PSI-00 176030. 

1877 http://www.occ.gov/topics/laws-regulations/enforcement-actions/index-enforcement-actions.html 
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coordination, using such tools as wire transfers, cash letters, and controlled disbursement 
services. The volume of PCM activity at HBUS, given the bank's size, global reach, and 
appetite for risk, was huge both in terms of dollars and number of transactions. In 2009, for 
example, PCM processed 30.2 trillion wire transfers involving $94.5 trillion. 

In December 2007, the OCC completed an examination of AML controls in PCM 
operations and found that the bank was not adequately monitoring PCM transactions. The 
OCC examination noted fundamental flaws in the bank's AML controls and monitoring systems 
to identify suspicious activity as well as actions to clear alerts without adequately reviewing the 
circumstances and filing required SARs. It also recited several examples of suspicious activity 
and criticized the bank's Compliance Review Unit which is supposed to conduct independent 
testing of HBUS' AML controls but had not reviewed the PCM operations in three years. The 
examination findings included the following: 

• "Systems and Controls are less than satisfactory and do not provide an appropriate level 
of monitoring for suspicious and unusual activity for all of the activities in the business 
unit. 

• In reviewing customer activity, there were several accounts which warranted additional 
monitoring and/or in which monitoring practices were inadequate." 1880 

The examination also identified three MRAs that should be brought to the attention of HBUS' 

1 1 

board of directors. 

The Supervisory Letter signed by the OCC Examiner-in-Charge and sent to HBUS was 
issued four months later, on April 21, 2008, and conveyed a very different message about PCM 
operations, in part because HBUS had begun to correct the identified problems. The 
Supervisory Letter stated that the examination of PCM operations found that "the quality of risk 
management systems is satisfactory"; "compliance with legal and regulatory requirements is 
satisfactory"; and "the quality of PCM compliance risk management is satisfactory." It 
continued: "Policies and procedures are adequate; however, control systems needed to detect 

1883 

and report suspicious activity warrant improvement." These mild statements made in the 
spring of 2008, are worlds apart from the blunt examination findings issued in December 2007. 



igyg 9/13/2 oio OCC Supervisory Letter HSBC-2010-22, "Bank Secrecy Act/Anti-Money Laundering ('BSA/AML') 
Examination - Program Violation (12 U.S.C. § 1818(s); 12 C.F.R. § 21.21)," OCC-PSI-00864335. [Sealed 
Exhibit.] 

1879 12/7/2007 OCC memorandum "BSA/AML Examination - Payment and Cash Management," OCC-PSI- 
01263586. 

1880 Id. 

1881 The three MRAs were: "1) management needs to improve client monitoring and analysis in order to obtain an 
accurate view of potential risk. When an alert is generated, a more thorough review of available information needs 
to be initiated; 2) management must ensure that CRU [Compliance Review Unit] appropriately identifies and 
accurately reports on all issues, including MRAs. In addition, MRA follow-up by CRU needs to address all 
corrective action and include testing to determine the adequacy of actions taken; and 3) management needs to ensure 
that decisions related to not filing SARs are documented and maintain this information in a log." Id. 

1882 4/21/20O8 OCC Supervisory Letter HSBC-2007-24, "Payment and Cash Management BSA/AML Examination", 
OCC-PSI-00107597. [Sealed Exhibit.] 

1883 Id. all. 
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Despite its language, the Supervisory Letter did include the three MRAs which, together, implied 
a significant breakdown in the bank's internal controls. 

Embassy Banking Examination. A second example involved HBUS' Embassy 
Banking examination. As discussed earlier, in January 2008, after being contacted by two 
former employees, OCC conducted an examination and confirmed a wide array of troubling 
practices in the Embassy Banking unit. They included significant internal control problems, 
suspicious activity involving two high risk embassy accounts, noncompliance with bank policy, 
inadequate due diligence and monitoring, transactions being conducted without OF AC screening 
- describing, in short, some of the most egregious AML deficiencies recorded in any HBUS 

1 884 

AML examination. 100 " On May 20, 2008, the OCC examiner completed a Conclusion 
Memorandum with the examination findings, stating that the Embassy Banking's "AML 
program is not effective in identifying and mitigating risk, especially considering the nature of its 
clientele and the types of products and services it provides." 1 85 The memorandum 
recommended issuance of a Cease and Desist Order to ensure immediate remediation of the 
AML risks. The OCC examiner also discussed the recommendation for a formal enforcement 
action with the Examiner-in-Charge, but was informed that no Cease and Desist Order would be 
issued. HBUS was verbally informed of the examination findings and immediately began work 
to address the problems. In July, a follow-up examination looked at the bank's remedial efforts 
and found that progress had been made. 

On September 4, 2008, a Supervisory Letter summarized the March and July 
examinations was sent to HBUS. 1887 The letter's mild tone failed to convey any of the egregious 
AML deficiencies or suspicious activity uncovered during the examinations, using instead bland 
language that conveyed minimal concern or urgency. The letter began: 



• "The quality of risk management is satisfactory, but needs improvements in certain areas. 

• Compliance with legal and regulatory requirements is satisfactory and no violations of 
law or regulation were cited at this examination. 

• We noted several deficiencies in the GIB BSA/AML program that warrant the immediate 
remedial attention of senior management." 1888 



The letter continued with a string of positive statements: "Management is competent and 
capable." "The automation of existing systems and controls, together with current staff levels, 
will ensure a timely and efficient process for monitoring accounts . . . ." "Currently, monitoring 
remains backlogged; however, management has developed a plan to bring the monitoring up to 
date." "Current systems and controls are satisfactory." "Compliance Risk is stable." 



See also earlier discussion; 5/20/2008 OCC Memorandum," Government and Institutional Banking", OCC-PSI- 
00928614; 10/8/2008 OCC Memorandum "Royal Embassy of Saudi Arabia (RESA) March 2008 Examination 
Conclusions", OCC-PSI-01434609; 4/3/2008 OCC Memorandum "Libyan Relationship Review ", OCC-PSI- 
01434593. 

1885 5/20/2008 OCC Memorandum "Government and Institutional Banking", OCC-PSI-00899215. 

1886 See 8/14/2008 OCC Conclusion Memorandum, "Government and Institutional Banking Update," OCC-PSI- 
00899227. 

1887 9/4/2008 OCC Supervisory Letter HSBC-2008-07, "Government and Institutional Banking BSA/AML 
Examination," to HBUS, OCC-PSI-00107607. [Sealed Exhibit.] 

1888 Id. at OCC-PSI-00 107607-608. 
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The Supervisory Letter continued: 

"Our current review has noted a marked improvement to GIB's BSA/AML program from 
the second quarter of 2008 examination. Management has implemented corrective action 
in most of the areas of concern. The new GIB Compliance manager has implemented 
numerous objectives to ensure that potential risk is readily identified and mitigated to 
acceptable levels. 

There are still some issues with system and controls, resources and alert monitoring; 
however, based on the current review those deficiencies are noted as MRAs." 

The Supervisory Letter then reduced the AML examiner's request for a formal enforcement 
action against the bank to two narrow MRAs asking HBUS to: (1) "develop plans with 
milestones to further define and automate the risk identification and monitoring functions," and, 
in the interim, "continue to enhance methods to reduce weaknesses associated with manual 
intervention" and prevent "unauthorized changes" to a spreadsheet with account information; 
and (2) cure a backlog of 1,800 alerts, some dating back to 2007, by September 15, 2008. 1890 

The September Supervisory Letter simply did not convey the urgency or severity of the 
examination findings from several months earlier regarding AML problems in the Embassy 
Banking department. In addition, while it presented two MRAs requring corrective action, its 
mild tone and lack of detail may make bringing an enforcement action difficult if the bank fails 
to remedy the identified problems in a timely fashion. 

AML Staffing Problems. A third example of discrepancies between examination 
findings and the Supervisory Letters that follow involved staffing issues. 

In 2006, two OCC Supervisory Letters included MRAs that required HBUS to increase 
AML staffing in its Embassy Banking unit to monitor transactions 1891 and in its Compliance 

1 892 

Review Unit to conduct internal reviews of the bank's AML controls. In 2007, another 
Supervisory Letter again included an MRA about increasing AML staffing in the Embassy 
Banking unit. 10 " Two years later, in 2009, OCC AML examiners conducted examinations of 
HBUS' OFAC Compliance unit, Correspondent Banking, and PCM department, and identified 
staffing issues at all three. In February 2009, the OCC examiners wrote an internal 
memorandum to the file recording a disagreement with their supervisor concerning staffing. In 
the memorandum, the examiners identified inadequate AML staffing as "a repetitive issue that is 
of concern" that "should be elevated to an MRA instead of a recommendation for the 
Correspondent Banking (March 3, 2009 Supervisory Letter) and Payment and Cash Management 
examinations (March 18, 2009 Supervisory Letter)." 1894 The memorandum also noted that the 



1889 Id. at OCC-PSI-00 107609. 

1890 Id. at OCC-PSI-00 1076 10. 

1891 1/30/2006 OCC Supervisory Letter to HBUS, OCC-PSI-00107529, at 534-35. [Sealed Exhibit.] 

1892 6/14/2006 OCC Supervisory Letter HSBC-2006-16, "Compliance Review Unit Examination," OCC-PSI- 
00000341. [Sealed Exhibit.] 

1893 3/19/2007 OCC Supervisory Letter HSBC-2006-30, "Government and Institutional Banking BSA/AML 
Examination", OCC-PSI-00 107567, at 569-570. [Sealed Exhibit.] 

1894 2/5/2009 OCC Memorandum to files , "Staffing issue - Correspondent Banking," OCC-PSI-00899201. 
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two OCC examiners had discussed the issue with the OCC Examiner-in-Charge who disagreed 
with the examiners' assessment, because "there are no violations being cited and staffing is a 
management decision." The memorandum concludes: "Based on our growing concerns 
regarding Ms. Midzain's qualifications to hold the position as BSA/AML officer, her lack of 
concern with our recommendations and a slow deterioration of the bank's BSA/AML Program, 
[we] will recommend to EIC Belshaw that we complete a Compliance Management examination 
to assess BSA management as soon as possible." 

The Examiner-in-Charge sent out three Supervisory Letters related to the examinations 
that had been conducted. Each reduced the requested MRA down to a recommendation that 
"management should consider a review of current and immediate staffing." At that point, the 
OCC had identified staffing problems in five business units through six exams over a period of 
four years, but the most recent Supervisory Letters treated the need to increase AML staffing as a 
recommendation rather than an MRA requiring corrective action. While it is the function of an 
Examiner-in-Charge to make the ultimate decision on MRAs and recommendations, this 
example demonstrates a clear division between the Examiner-in-Charge and her staff and a 
refusal to take strong action by the more senior OCC official. 

In Washington, the OCC's Large Bank Review Committee, which reviewed about six 
draft Supervisory Letters per year for HBUS and sometimes had a copy of the underlying 
examinations, also noted occasional discrepancies between the examination findings and draft 
Supervisory Letters. In addition, some LBRC members began to notice after the fact that some 
examinations had revealed more significant AML problems and criticism of HBUS operations 
than were conveyed by the approved Supervisory Letters to HBUS management. As a result, the 
LBRC now requires both the AML examiner's Conclusion Memorandum and the Examiner-in- 
Charge' s draft Supervisory Letter before it will begin a review of the draft letter. 1895 This 
change should help reduce the discrepancies and ensure senior OCC officials have a more 
complete view of AML problems at the banks being examined. 

D. Analysis 

AML laws are not intended to protect bank customers or the bank; they safeguard the 
U.S. financial system and the nation as a whole. As the regulator of nationally chartered banks, 
which are among the largest, most complex, and global of U.S. banks, the OCC plays a critical 
role in ensuring AML compliance. It is the OCC that needs to ensure the U.S. affiliates of global 
banks function as well-guarded gateways that keep out risk rather than invite it in. 

To fulfill its AML obligations, the OCC needs to strengthen its AML oversight and 
revamp its AML supervisory and enforcement approach to bring them into closer alignment with 
other federal bank regulators. Five reforms are key. First, it should treat AML deficiencies as a 
matter of safety and soundness, not consumer protection, and ensure ineffective AML 
management is taken into consideration when assigning a bank's CAMELS management and 
composite ratings. Second, the OCC should allow its examiners to cite violations of law for 
individual pillar violations as well as program-wide violations. Third, the OCC should ensure 
that narrowly focused examinations are considered in tandem with examinations that take a 
holistic view of a bank's AML program. Fourth, the OCC should make more use of informal 



Subcommittee interview of James Vivenzio (3/15/2012). 
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enforcement actions and reconsider its standards for issuing formal enforcement actions to 
compel AML reforms. Finally, the OCC should instruct its Examiners-In-Charge to accurately 
reflect AML examination findings, without turning them into such mild recommendations that 
they mislead bank management into thinking their AML programs are functioning well, when 
they are not. Many OCC examiners see the problems; it is OCC supervisors and enforcement 
that need to act to strengthen the OCC's AML oversight efforts. 



